Splunk Search

Using If then in combination with case

kennyja
Explorer

I would like to create a new tag field based on multiple conditions. I think I have figured out how to specify my conditions, but I would like to create a true/false result in a new field. I am not sure how to do this.

Here is my command so far. I would like to create a new true/false field based on whether or not "hostgroup" is a match with all of the conditions specified. Should return true is case is a match, and false if not.

sourcetype= | eval hostgroup=case(host LIKE "%BE%", "BE", host LIKE "%MT%", "MT", host LIKE "%FE%", "FE", host LIKE "%", "Others")

Any tips on how to setup the true/false portion of my request?

Thanks

Tags (1)
0 Karma

Runals
Motivator

Not sure if this is what you are thinking of but I'd add , 1=1, "Other") at the end of my case statement. That way something evaluates to true. Actually what I normally use for the string is 'fixme' 😃

0 Karma

sundareshr
Legend

You can append this to your search (assuming your case statement is returning as expected)

.... | eval found=if(hostgroup="Others", false, true)
0 Karma

ryanoconnor
Builder

Just to clarify, the "Others" value here is not indicative of all of the previous matches conditions being met but it's the opposite. "Others" in this case means that the hostgroup string did not contain BE, MT, or FE.

If you append what @sundareshr is suggesting, the string 'found' would be false if the hostgroup string did not contain BE, MT, or FE and would be true if the hostgroup string contained any one of those things.

I'm not sure if Others is supposed to represent that or not, but if it is this should take care of your issue.

0 Karma

ryanoconnor
Builder

is hostgroup a field in your data? Can you let us know specifically what a true and a false condition would look like?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...