Splunk eval if ELSE or case

[kranthimutyala]

Hi All,

Im working on windows AD data and gathering info from various eventIds.

i have grouped the eventIds and each group has a specific Action field in the output table based on the fields related to those eventIds

For Eg: (eventId=1234 OR eventid=2345 OR eventId=3456) => Action field should have the value Action1(which is alos field created with the values related to these 3 event Ids)

similary

(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) => Action field should have the value Action2(which is also field created with the values related to these 4 event Ids)

similarly

(eventId=1122 OR eventid=2233 OR eventId=3344 ) => Action field should have the value Action3(which is also field created with the values related to these 3 event Ids)

I tried this logic in my spl using eval if and eval case but didnt get the expected ,can someone please look into it and help me with the soloution.

Thanks in advance.

[woodcock]

Like this

... | eval Action=case(
(eventId=1234 OR eventid=2345 OR eventId=3456), Action1,
(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) , Action2,
(eventId=1122 OR eventid=2233 OR eventId=3344 ), Action3,
true(), "OOPS!")

[richgalloway · Accepted solution]

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...

[woodcock]

I think that he means the value in Action#, not the value of Action# but he only wrote, the value Action# so we shall see...

[richgalloway]

Understood, but it's easy enough to remove quotation marks.