Splunk Search

Why eval case with comparison operators doesn't return expected result?

hcastell
Path Finder

Hi all, I am using the following search string to determine if a specific value in a table falls between 34 and 50 (pass) or >50 OR <34 (fail):

eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr >="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail") 

The above works fine except when the value us actually =50 then the result show fail. Trying to figure out what I am missing. A value of 50 should be a pass. Appreciate any insight you could offer.

Howard.

1 Solution

lguinn2
Legend

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

View solution in original post

lguinn2
Legend

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

hcastell
Path Finder

Thanks for your suggestion. All is working now.

0 Karma

hcastell
Path Finder

The field that I added to my comment didn't come out properly so let me try again using quotes:

"50.0 dBmV"

0 Karma

hcastell
Path Finder

Thanks for your suggestion but the result was the same (ie. still does not work). Here is the value that I am testing against from the xml file:

50.0 dBmV

0 Karma

ppablo
Retired

Hi @hcastell

Just taking a stab at this, but would this work for your case?

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwr > "50" OR TestTxPwr < "34", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass")
0 Karma

hcastell
Path Finder

Correction to my search string:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail")

This is the one I am having issues with.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...