Splunk Search

Why does multiple eval statements cause only last to be run?

markhvesta
Path Finder

I am trying to create a low volume type of alert based on one sourcetype for multiple Channels that have very different amounts of traffic. The search I am using is as follows:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold?=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold?=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| table Channel Count MeetThreshold?

In my tests, it seems the results only reflect the status of the last eval statement. Is there a better way to do this?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

View solution in original post

woodcock
Esteemed Legend

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

markhvesta
Path Finder

That is perfect. Thank you

jkat54
SplunkTrust
SplunkTrust

Thats because your defining the same field name. try this approach instead:

 sourcetype="mytraffic"
 | chart count as Count by Channel
 | eval MeetThreshold1=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
 | eval MeetThreshold2=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
 | eval MeetThreshold=coalesc(MeetThreshold1,MeetThreshold2)
 | table Channel Count MeetThreshold
0 Karma

jkat54
SplunkTrust
SplunkTrust

Or you can make one long case / if:

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=if((Count<=4 AND Channel=="Web"),"Fail",if((Count<=400 AND Channel=="Mobile"),"Fail","Pass")))
  | table Channel Count MeetThreshold

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=case(
   Count<=4 AND Channel=="Web","Fail",
   Count<=400 AND Channel=="Mobile","Fail",
   1=1,"Pass")
  | table Channel Count MeetThreshold
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...