Splunk Reporting- condition where I have to create a new field based off some column values?

[revanthammineni]

Hi Splunkers,

I'm working on a condition where i have to create a new field based off some column values.
Example:
Column A      Column B         column c  
yes                    no                        abc
yes                   yes                        ef
yes                   no                          gh
no                     no                          kl
no                     no                          mn
Based of the columns, I need to create a new field called "result" based of two conditions.
1. if column c is abc or gh or mn then result is "yes"
2. If Column A or Column B is yes, then result should be "yes"

I tried doing with eval but one is replacing with other condition. I want to apply the first condition first and for the remaining values I need to check for second condition.

[Tom_Lundie · Accepted solution]

There are a few ways to approach this.

The if syntax is as follows:
| eval field = if(condition, match_value, no_match_value)

The crux of the solution is nest your second condition within the no_match_value. For example:

| eval result=if(IN('column c', "abc", "gh", "mn"), "yes", if('Column A'="yes" OR 'Column B'="yes", "yes", "no"))

[revanthammineni]

Worked like a charm. Thank you!!

[ITWhisperer]

| eval result=if(c=="abc" OR c=="gh" OR c=="mn","yes",if(a=="yes" OR b=="yes","yes",null()))

[Tom_Lundie]

Watch out for the extra double-quote just before the "abc".