Splunk Search

Splunk eval if ELSE or case

kranthimutyala
Path Finder

Hi All,

Im working on windows AD data and gathering info from various eventIds.

i have grouped the eventIds and each group has a specific Action field in the output table based on the fields related to those eventIds

For Eg: (eventId=1234 OR eventid=2345 OR eventId=3456) => Action field should have the value Action1(which is alos field created with the values related to these 3 event Ids)

similary

(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) => Action field should have the value Action2(which is also field created with the values related to these 4 event Ids)

similarly

(eventId=1122 OR eventid=2233 OR eventId=3344 ) => Action field should have the value Action3(which is also field created with the values related to these 3 event Ids)

I tried this logic in my spl using eval if and eval case but didnt get the expected ,can someone please look into it and help me with the soloution.

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

woodcock
Esteemed Legend

Like this

... | eval Action=case(
(eventId=1234 OR eventid=2345 OR eventId=3456), Action1,
(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) , Action2,
(eventId=1122 OR eventid=2233 OR eventId=3344 ), Action3,
true(), "OOPS!")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

... | eval Action = case(eventId=1234 OR eventId=2345 OR eventId=3456, "Action1",
                         eventId=9876 OR eventID=8765 OR eventId=7654 OR eventId=5432, "Action2",
                         eventId=1122 OR eventId=2233 OR eventId=3344, "Action3") | ...
---
If this reply helps you, Karma would be appreciated.

woodcock
Esteemed Legend

I think that he means the value in Action#, not the value of Action# but he only wrote, the value Action# so we shall see...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Understood, but it's easy enough to remove quotation marks.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...