Splunk Search

Using case in an eval statement, with values undefined in the case function displayed in stats table as well.

Engager

The command I am running is:

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by number

But when I run this I also want to display the values that are undefined in the eval line. How would one go about this?

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Add an entry in the case.

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" , 1==1, "undefined") | stats count by number
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!