Splunk Search

Using AND in case() function

Paxxxman
Explorer

Hi all,

I'm currently trying to get the case() function working so that for each .csv file I have (which has information saved in the exact same format as the other, even though the information is pertaining to different things entirely) I can turn the information back into meaningful data.

Example - .csv files are named SHB_00X_[DATE].csv where X ranges from 1-8. Each of those .csv files bring in a value LANE, ranging from 1-3 or 1-4. However, the actual lanes in our system range from 1-19. So when I do a standard "stats count by LANE", I only get counts on lanes 1-4, but I need a count for 1-19.

So I tried to change the LANE name with the following case function:

eval RoadLane=case(source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="1", "17", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="2", "18", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="3", "19")

and the case() function goes on and on to sort out each lane by source AND lane. The search does not work at all. Any ideas why that is?

All help is appreciated! Thanks!

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

View solution in original post

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

Paxxxman
Explorer

Woops I didn't see that! Hahaha thanks again!

0 Karma

hexx
Splunk Employee
Splunk Employee

Glad to hear that! Please feel free to accept my answer 🙂

0 Karma

Paxxxman
Explorer

That did it! Thank you so much.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...