Splunk Search

Why does multiple eval statements cause only last to be run?

markhvesta
Path Finder

I am trying to create a low volume type of alert based on one sourcetype for multiple Channels that have very different amounts of traffic. The search I am using is as follows:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold?=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold?=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| table Channel Count MeetThreshold?

In my tests, it seems the results only reflect the status of the last eval statement. Is there a better way to do this?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

View solution in original post

woodcock
Esteemed Legend

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

markhvesta
Path Finder

That is perfect. Thank you

jkat54
SplunkTrust
SplunkTrust

Thats because your defining the same field name. try this approach instead:

 sourcetype="mytraffic"
 | chart count as Count by Channel
 | eval MeetThreshold1=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
 | eval MeetThreshold2=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
 | eval MeetThreshold=coalesc(MeetThreshold1,MeetThreshold2)
 | table Channel Count MeetThreshold
0 Karma

jkat54
SplunkTrust
SplunkTrust

Or you can make one long case / if:

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=if((Count<=4 AND Channel=="Web"),"Fail",if((Count<=400 AND Channel=="Mobile"),"Fail","Pass")))
  | table Channel Count MeetThreshold

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=case(
   Count<=4 AND Channel=="Web","Fail",
   Count<=400 AND Channel=="Mobile","Fail",
   1=1,"Pass")
  | table Channel Count MeetThreshold
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...