Splunk Search

Splunk Reporting- condition where I have to create a new field based off some column values?

revanthammineni
Path Finder

Hi Splunkers,

I'm working on a condition where i have to create a new field based off some column values.
Example:
Column A      Column B         column c  
yes                    no                        abc
yes                   yes                        ef
yes                   no                          gh
no                     no                          kl
no                     no                          mn
Based of the columns, I need to create a new field called "result" based of two conditions.
1. if column c is abc or gh or mn then result is "yes"
2. If Column A or Column B is yes, then result should be "yes"

I tried doing with eval but one is replacing with other condition. I want to apply the first condition first and for the remaining values I need to check for second condition.

Labels (3)
Tags (3)
0 Karma
1 Solution

Tom_Lundie
Contributor

There are a few ways to approach this.

The if syntax is as follows:
| eval field = if(condition, match_value, no_match_value)

The crux of the solution is nest your second condition within the no_match_value. For example:

| eval result=if(IN('column c', "abc", "gh", "mn"), "yes", if('Column A'="yes" OR 'Column B'="yes", "yes", "no"))

 

View solution in original post

Tom_Lundie
Contributor

There are a few ways to approach this.

The if syntax is as follows:
| eval field = if(condition, match_value, no_match_value)

The crux of the solution is nest your second condition within the no_match_value. For example:

| eval result=if(IN('column c', "abc", "gh", "mn"), "yes", if('Column A'="yes" OR 'Column B'="yes", "yes", "no"))

 

revanthammineni
Path Finder

Worked like a charm. Thank you!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| eval result=if(c=="abc" OR c=="gh" OR c=="mn","yes",if(a=="yes" OR b=="yes","yes",null()))

 

0 Karma

Tom_Lundie
Contributor

Watch out for the extra double-quote just before the "abc".

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...