Splunk Search

Is it possible to write switch case statements in Splunk like other programming languages?

soumidutta
Explorer

Hi ,

Can it be possible to write switch case statements in Splunk like other programming languages?
If so, can you help me out with the syntax?

Tags (1)
0 Karma

renjith_nair
Legend

@soumidutta,

Yes , using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.2...

---
What goes around comes around. If it helps, hit it with Karma 🙂

soumidutta
Explorer

Thanks
I was looking for this one

0 Karma

renjith_nair
Legend

@soumidutta,
Please accept as answer if it helped you. thanks

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...