Splunk Search

Using Eval statement

Splunk_rocks
Path Finder

Hello Splunkers,
I have case field with below information so i need to construct Eval field.

case**

XYZ
2
0
3
yzr

Now i have to construct eval field like

If case=string then print case as it was in case field
case=2 then print " error code 2"
case =3 the print " error code 3"
case=0 then " error zero "

Tags (2)
0 Karma
1 Solution

ssadanala1
Contributor

Try this

| makeresults
| eval temp="XYZ,2,0,3,yzr"
| eval temp = split(temp,",")
| mvexpand temp
| eval status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

View solution in original post

0 Karma

ssadanala1
Contributor

Try this

| makeresults
| eval temp="XYZ,2,0,3,yzr"
| eval temp = split(temp,",")
| mvexpand temp
| eval status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

0 Karma

Splunk_rocks
Path Finder

Thanks but that will not fulfill my req i need add Eval field to props file based on output.

0 Karma

ssadanala1
Contributor

You can use this in caluclated fields in props.conf by specifying like this

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Minor cosmetic correction:

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",isstr(temp), ,temp)
0 Karma

Splunk_rocks
Path Finder

Thanks somesoni & ssadanala1 it worked for me now.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...