Splunk Search

Using case in an eval statement, with values undefined in the case function displayed in stats table as well.

amcb90
Engager

The command I am running is:

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by number

But when I run this I also want to display the values that are undefined in the eval line. How would one go about this?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add an entry in the case.

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" , 1==1, "undefined") | stats count by number
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.