Splunk Search

If statement with AND

mansel_scheffel
Explorer

Hi,

Is it possible to use AND in an eval if statement.. for instance if(volume =10, "normal" if(volume >35 AND <40, "loud")) and so on.. I would like to add a few more if's into that as well..Any thoughts on how to structure it?

0 Karma
1 Solution

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

View solution in original post

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

hardikJsheth
Motivator

You can use case statement instead the syntax is
case (condition , TRUE, FALSE)

You can have nested case statements as well for eg.
|index=main | eval system=case(isnotnull(dest) AND dest!="unknown",dest,isnotnull(src) AND src!="unknown",src,isnotnull(dvc) AND dvc!="unknown",dvc,1=1,"unknown")

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...