Splunk Search

Reassign (or keep) variable in eval's IF statement

kevintelford
Path Finder

I have two variables and based on one would like to possible change the value of the other:

.. | eval a="foo" | eval b="some value" | eval a=if(match(b, "kittens"), "bar", a)

So if b contains 'kittens' make a's value equal 'bar', otherwise keep it 'foo'. Is this possible? As it stands now a only ever has a value when b contains 'kittens'.

Thanks,
Kevin

Tags (3)
1 Solution

fk319
Builder

well it seems it should work, so I went to my code to see how I implemented it, I ended up using a case command with the last expression as 1==1.

 eval a=case(match(b, "kittens"), "bar", 1==1,a)

It seems that I had the same issue also, and this was how I was able to get it to work.

View solution in original post

fk319
Builder

well it seems it should work, so I went to my code to see how I implemented it, I ended up using a case command with the last expression as 1==1.

 eval a=case(match(b, "kittens"), "bar", 1==1,a)

It seems that I had the same issue also, and this was how I was able to get it to work.

kevintelford
Path Finder

Cool deal, too bad it doesn't work with if as well, but this will do just fine. Thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...