Splunk Search

If statement

vaibhavbeohar
Path Finder

Hi
I am running search to get rating status in my report, not getting any result and getting error
" Error in 'eval' command: The expression is malformed. Expected ) " here is my search,

Thanks

"sourcetype="TicketAnalysis" | eval XYZ = if (Rating1 >="6", "Satisfied", if (Rating1 <="6" AND Rating1 >= "4" "Neutral", if (Rating1 < "4" AND Rating1 >= 1, "Dissatisfied","Unrated"))) "

Tags (1)

jbanerje
Explorer

eval Comment=if((Fund_Credit_Amt=Ack_Credit_Amt) AND (Fund_Debit_Amt=Ack_Debit_Amt) ,"MATCH","MISMATCH")

jhupka
Path Finder

Is there any particular reason you wouldn't use case instead?

smolcj
Builder
sourcetype="TicketAnalysis" | eval XYZ = if (Rating1 >="6", "Satisfied", if (Rating1 <="6" AND Rating1 >= "4" **,** "Neutral", if (Rating1 < "4" AND Rating1 >= 1, "Dissatisfied","Unrated")))

i think you missed a comma in second if statement . if (Rating1 <="6" AND Rating1 >= "4" , "Neutral"

smolcj
Builder

🙂 you have an option to remove other from pie graph in a dashboard . append this
0
thisanswer may help you;;

0 Karma

vaibhavbeohar
Path Finder

Thanks, this works now ,but if i select pie graph i am getting extra field other (1), do you have any idea why its coming only on pie graph ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...