Splunk Search

If statement with AND

mansel_scheffel
Explorer

Hi,

Is it possible to use AND in an eval if statement.. for instance if(volume =10, "normal" if(volume >35 AND <40, "loud")) and so on.. I would like to add a few more if's into that as well..Any thoughts on how to structure it?

0 Karma
1 Solution

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

View solution in original post

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

hardikJsheth
Motivator

You can use case statement instead the syntax is
case (condition , TRUE, FALSE)

You can have nested case statements as well for eg.
|index=main | eval system=case(isnotnull(dest) AND dest!="unknown",dest,isnotnull(src) AND src!="unknown",src,isnotnull(dvc) AND dvc!="unknown",dvc,1=1,"unknown")

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...