- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using case in an eval statement, with values undefined in the case function displayed in stats table as well.

amcb90
Engager
11-19-2019
07:48 AM
The command I am running is:
basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by number
But when I run this I also want to display the values that are undefined in the eval line. How would one go about this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
11-19-2019
08:34 AM
Add an entry in the case
.
basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" , 1==1, "undefined") | stats count by number
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
