Splunk Search
Highlighted

Why eval case with comparison operators doesn't return expected result?

Path Finder

Hi all, I am using the following search string to determine if a specific value in a table falls between 34 and 50 (pass) or >50 OR <34 (fail):

eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr >="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail") 

The above works fine except when the value us actually =50 then the result show fail. Trying to figure out what I am missing. A value of 50 should be a pass. Appreciate any insight you could offer.

Howard.

Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Path Finder

Correction to my search string:

| eval DOCSISTxPWRRdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail")

This is the one I am having issues with.

0 Karma
Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Community Manager
Community Manager

Hi @hcastell

Just taking a stab at this, but would this work for your case?

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwr > "50" OR TestTxPwr < "34", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass")
0 Karma
Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Path Finder

Thanks for your suggestion but the result was the same (ie. still does not work). Here is the value that I am testing against from the xml file:

50.0 dBmV

0 Karma
Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Path Finder

The field that I added to my comment didn't come out properly so let me try again using quotes:

"50.0 dBmV"

0 Karma
Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Legend

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

View solution in original post

Highlighted

Re: Why eval case with comparison operators doesn't return expected result?

Path Finder

Thanks for your suggestion. All is working now.

0 Karma