Splunk Search

If len() then A else B

sai33
Explorer

Hi All,

I'm looking to include a If Else Check along with Len() Function along with Eval in my Search.

My Raw syntax would be something like this:
If Len(A)>o then 'A' else 'B'

Can you please help out on creating something like the above statement using Eval.

Thanks!

0 Karma
1 Solution

MuS
Legend

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

sai33
Explorer

Thanks @MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...