Splunk Search

Need help in eval case - nested eval possible ?

gopiven
Explorer

I've created a summary index where it contains 6 eval cases,
for example: eval 1=case(match(something,"a",...."b","c"), eval 2 =case (d,e,f)....eval 6=case(x,y,z)
where a,b,c....x,y,z are the individual detailed functions and 1,2,3,4,5,6 are overall functions.

Now I have combined all eval functions into a single value using eval Total_Function = mvappend(1,2,3,4,5,6).

But I want to list the table with both overall function & individual detailed function as well. But I am not sure how to get individual detail values in the table along with overall function.

Expected table as below:

Time Total_Function      Overallfunction Individual function

XX     T otal_Function          1                               a
YY       Total_Function          1                               b
ZZ       Total_Function          1                               c
AA       Total_Function         6                               x
BB       Total_Function         6                               y
CC      Total_Function          6                               z                     

Kindly help me please.

(Please note, there are multiple individual functions in each eval case)

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...