Splunk Search

Nested comparisons (using AND / OR with IF / CASE functions)- How would I add a second condition?

mark_cet
Path Finder

Hi everyone,

 

I am attempting to implement some logic in my alert searches but I can't seem to figure out how to do it.

 

I have some event data coming into Splunk that I want to trigger a Service Now incident creation using a priority value based on the event severity and the host environment (test, stage, prod, DR).

 

I am using a case statement to assign a severity ID depending on the alert severity:

| eval severity_id=case(Severity=="critical", 6, Severity=="major", 5, 1==1, 3)

 

If I want to add a second condition to check the value of the hostEnvironment field before setting the severity ID what would be the best way to do this?

E.G. If the severity = "critical" AND hostEnvironment = test then severity ID = 3.

E.G. If the severity = "critical" AND hostEnvironment = prod then severity ID = 6

etc. 

I am hoping there is a way to nest the comparison functions. 

 

Thanks in advance.

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You don't have to nest the conditionals.  You can just use the same statements as in your explanation.

 

| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)

 

To nest conditional just put another case or if function in place of the value clause.

 

| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)

 

Or an easier to read version:

 

| eval severity_id=case(
    Severity=="critical", 
       case(hostEnvironment="prod", 6, 
            hostEnvironment="test", 3, 
            1==1, 3), 
    Severity=="major", 5,
    1==1, 3)

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't have to nest the conditionals.  You can just use the same statements as in your explanation.

 

| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)

 

To nest conditional just put another case or if function in place of the value clause.

 

| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)

 

Or an easier to read version:

 

| eval severity_id=case(
    Severity=="critical", 
       case(hostEnvironment="prod", 6, 
            hostEnvironment="test", 3, 
            1==1, 3), 
    Severity=="major", 5,
    1==1, 3)

 

 

---
If this reply helps you, Karma would be appreciated.

mark_cet
Path Finder

Thank you very much for this richgalloway!

 

This worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...