Splunk Search

If len() then A else B

sai33
Explorer

Hi All,

I'm looking to include a If Else Check along with Len() Function along with Eval in my Search.

My Raw syntax would be something like this:
If Len(A)>o then 'A' else 'B'

Can you please help out on creating something like the above statement using Eval.

Thanks!

0 Karma
1 Solution

MuS
Legend

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

sai33
Explorer

Thanks @MuS

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...