Splunk Search

In a table, how do I designate a default message that shows under a certain condition?

gauravepi
Path Finder

I am checking the status code of the HTTP response. In one condition when HTTP code is 411, i don't get a message. So, in that condition, i want to have some default message in the table. But, i am unable to set a default message.

The below query is what I am using:

basic query |eval errMsg=if(status == "411", "Length missing",errMsg) |  table errMsg,status

For other cases, I want to have the errMsg the same as what I am getting back in search.

0 Karma
1 Solution

gauravepi
Path Finder

Below query worked me , i did a string comparison

basic query |eval errMsg=if('status' == "411", "Length missing",errMsg) | table errMsg,status

View solution in original post

0 Karma

gauravepi
Path Finder

Below query worked me , i did a string comparison

basic query |eval errMsg=if('status' == "411", "Length missing",errMsg) | table errMsg,status

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...