Splunk Search

Why eval case with comparison operators doesn't return expected result?

hcastell
Path Finder

Hi all, I am using the following search string to determine if a specific value in a table falls between 34 and 50 (pass) or >50 OR <34 (fail):

eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr >="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail") 

The above works fine except when the value us actually =50 then the result show fail. Trying to figure out what I am missing. A value of 50 should be a pass. Appreciate any insight you could offer.

Howard.

1 Solution

lguinn2
Legend

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

View solution in original post

lguinn2
Legend

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

hcastell
Path Finder

Thanks for your suggestion. All is working now.

0 Karma

hcastell
Path Finder

The field that I added to my comment didn't come out properly so let me try again using quotes:

"50.0 dBmV"

0 Karma

hcastell
Path Finder

Thanks for your suggestion but the result was the same (ie. still does not work). Here is the value that I am testing against from the xml file:

50.0 dBmV

0 Karma

ppablo
Retired

Hi @hcastell

Just taking a stab at this, but would this work for your case?

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwr > "50" OR TestTxPwr < "34", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass")
0 Karma

hcastell
Path Finder

Correction to my search string:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail")

This is the one I am having issues with.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...