Splunk Search

Splunk eval if ELSE or case

kranthimutyala
Path Finder

Hi All,

Im working on windows AD data and gathering info from various eventIds.

i have grouped the eventIds and each group has a specific Action field in the output table based on the fields related to those eventIds

For Eg: (eventId=1234 OR eventid=2345 OR eventId=3456) => Action field should have the value Action1(which is alos field created with the values related to these 3 event Ids)

similary

(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) => Action field should have the value Action2(which is also field created with the values related to these 4 event Ids)

similarly

(eventId=1122 OR eventid=2233 OR eventId=3344 ) => Action field should have the value Action3(which is also field created with the values related to these 3 event Ids)

I tried this logic in my spl using eval if and eval case but didnt get the expected ,can someone please look into it and help me with the soloution.

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this

... | eval Action=case(
(eventId=1234 OR eventid=2345 OR eventId=3456), Action1,
(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) , Action2,
(eventId=1122 OR eventid=2233 OR eventId=3344 ), Action3,
true(), "OOPS!")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I think that he means the value in Action#, not the value of Action# but he only wrote, the value Action# so we shall see...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Understood, but it's easy enough to remove quotation marks.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!