Splunk Search

Using AND in case() function

Paxxxman
Explorer

Hi all,

I'm currently trying to get the case() function working so that for each .csv file I have (which has information saved in the exact same format as the other, even though the information is pertaining to different things entirely) I can turn the information back into meaningful data.

Example - .csv files are named SHB_00X_[DATE].csv where X ranges from 1-8. Each of those .csv files bring in a value LANE, ranging from 1-3 or 1-4. However, the actual lanes in our system range from 1-19. So when I do a standard "stats count by LANE", I only get counts on lanes 1-4, but I need a count for 1-19.

So I tried to change the LANE name with the following case function:

eval RoadLane=case(source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="1", "17", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="2", "18", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="3", "19")

and the case() function goes on and on to sort out each lane by source AND lane. The search does not work at all. Any ideas why that is?

All help is appreciated! Thanks!

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

View solution in original post

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

Paxxxman
Explorer

Woops I didn't see that! Hahaha thanks again!

0 Karma

hexx
Splunk Employee
Splunk Employee

Glad to hear that! Please feel free to accept my answer 🙂

0 Karma

Paxxxman
Explorer

That did it! Thank you so much.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...