Splunk Search

If statement help

priya0709
Path Finder

I have a table generating fields Assignee, Support_tier, HR_Country, Hostdomain,

I have to Assign some values to 'Assignee' based on some values in other fields

Eg:  if Support_tier is 901 and HR_Country is Canada the Assignee value should be 'priya'                                              also if Support_tier is 908 & 909 Assignee should be 'udit'  

Kindly help with the query?? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval Assignee=case(Support_tier=901 AND HR_Country="Canada","priya",Support_tier=908 OR Support_tier=909,"udit")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Assignee=case(Support_tier=901 AND HR_Country="Canada","priya",Support_tier=908 OR Support_tier=909,"udit")
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...