Using Eval statement

[Splunk_rocks]

Hello Splunkers,
I have case field with below information so i need to construct Eval field.

case**

XYZ
2
0
3
yzr

Now i have to construct eval field like

If case=string then print case as it was in case field
case=2 then print " error code 2"
case =3 the print " error code 3"
case=0 then " error zero "

[ssadanala1 · Accepted solution]

Try this

| makeresults
| eval temp="XYZ,2,0,3,yzr"
| eval temp = split(temp,",")
| mvexpand temp
| eval status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

[Splunk_rocks]

Thanks but that will not fulfill my req i need add Eval field to props file based on output.

[ssadanala1]

You can use this in caluclated fields in props.conf by specifying like this

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

[somesoni2]

Minor cosmetic correction:

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",isstr(temp), ,temp)

[Splunk_rocks]

Thanks somesoni & ssadanala1 it worked for me now.