Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- If statement
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If statement
Hi
I am running search to get rating status in my report, not getting any result and getting error
" Error in 'eval' command: The expression is malformed. Expected ) " here is my search,
Thanks
"sourcetype="TicketAnalysis" | eval XYZ = if (Rating1 >="6", "Satisfied", if (Rating1 <="6" AND Rating1 >= "4" "Neutral", if (Rating1 < "4" AND Rating1 >= 1, "Dissatisfied","Unrated"))) "
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
eval Comment=if((Fund_Credit_Amt=Ack_Credit_Amt) AND (Fund_Debit_Amt=Ack_Debit_Amt) ,"MATCH","MISMATCH")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any particular reason you wouldn't use case instead?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sourcetype="TicketAnalysis" | eval XYZ = if (Rating1 >="6", "Satisfied", if (Rating1 <="6" AND Rating1 >= "4" **,** "Neutral", if (Rating1 < "4" AND Rating1 >= 1, "Dissatisfied","Unrated")))
i think you missed a comma in second if statement . if (Rating1 <="6" AND Rating1 >= "4" , "Neutral"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
🙂 you have an option to remove other from pie graph in a dashboard . append this
0
thisanswer may help you;;
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, this works now ,but if i select pie graph i am getting extra field other (1), do you have any idea why its coming only on pie graph ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
