Splunk Search

Nested comparisons (using AND / OR with IF / CASE functions)- How would I add a second condition?

mark_cet
Explorer

Hi everyone,

 

I am attempting to implement some logic in my alert searches but I can't seem to figure out how to do it.

 

I have some event data coming into Splunk that I want to trigger a Service Now incident creation using a priority value based on the event severity and the host environment (test, stage, prod, DR).

 

I am using a case statement to assign a severity ID depending on the alert severity:

| eval severity_id=case(Severity=="critical", 6, Severity=="major", 5, 1==1, 3)

 

If I want to add a second condition to check the value of the hostEnvironment field before setting the severity ID what would be the best way to do this?

E.G. If the severity = "critical" AND hostEnvironment = test then severity ID = 3.

E.G. If the severity = "critical" AND hostEnvironment = prod then severity ID = 6

etc. 

I am hoping there is a way to nest the comparison functions. 

 

Thanks in advance.

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You don't have to nest the conditionals.  You can just use the same statements as in your explanation.

 

| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)

 

To nest conditional just put another case or if function in place of the value clause.

 

| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)

 

Or an easier to read version:

 

| eval severity_id=case(
    Severity=="critical", 
       case(hostEnvironment="prod", 6, 
            hostEnvironment="test", 3, 
            1==1, 3), 
    Severity=="major", 5,
    1==1, 3)

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't have to nest the conditionals.  You can just use the same statements as in your explanation.

 

| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)

 

To nest conditional just put another case or if function in place of the value clause.

 

| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)

 

Or an easier to read version:

 

| eval severity_id=case(
    Severity=="critical", 
       case(hostEnvironment="prod", 6, 
            hostEnvironment="test", 3, 
            1==1, 3), 
    Severity=="major", 5,
    1==1, 3)

 

 

---
If this reply helps you, Karma would be appreciated.

mark_cet
Explorer

Thank you very much for this richgalloway!

 

This worked perfectly.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...