Splunk Search

If len() then A else B

sai33
Explorer

Hi All,

I'm looking to include a If Else Check along with Len() Function along with Eval in my Search.

My Raw syntax would be something like this:
If Len(A)>o then 'A' else 'B'

Can you please help out on creating something like the above statement using Eval.

Thanks!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sai33,

give this a try:

| makeresults | eval A="", B="22" `comment("creates fake events")` 
| eval result_len_0=if(len(A) > 0, A, B)

Hope this helps ...

cheers, MuS

sai33
Explorer

Thanks @MuS

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...