Splunk Search

Splunk eval if ELSE or case

kranthimutyala
Path Finder

Hi All,

Im working on windows AD data and gathering info from various eventIds.

i have grouped the eventIds and each group has a specific Action field in the output table based on the fields related to those eventIds

For Eg: (eventId=1234 OR eventid=2345 OR eventId=3456) => Action field should have the value Action1(which is alos field created with the values related to these 3 event Ids)

similary

(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) => Action field should have the value Action2(which is also field created with the values related to these 4 event Ids)

similarly

(eventId=1122 OR eventid=2233 OR eventId=3344 ) => Action field should have the value Action3(which is also field created with the values related to these 3 event Ids)

I tried this logic in my spl using eval if and eval case but didnt get the expected ,can someone please look into it and help me with the soloution.

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

woodcock
Esteemed Legend

Like this

... | eval Action=case(
(eventId=1234 OR eventid=2345 OR eventId=3456), Action1,
(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) , Action2,
(eventId=1122 OR eventid=2233 OR eventId=3344 ), Action3,
true(), "OOPS!")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, Karma would be appreciated.

woodcock
Esteemed Legend

I think that he means the value in Action#, not the value of Action# but he only wrote, the value Action# so we shall see...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Understood, but it's easy enough to remove quotation marks.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...