Splunk Search

combine where and eval

pduvofmr
Path Finder

Hi Community,

how do i combine where and eval?
Available field are "Gear" and "Torque_Crankshaft"

Discribed in my human brain / language 😉

eval "Torque_Wheel" = (where ("Gear"=1 == ("Torque_Crankshaft"*5.0000)), ("Gear"=2 == ("Torque_Crankshaft"*3.2000")), ("Gear"=3 == ("Torque_Crankshaft"*2.1429)))

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

Have you looked at the case function?

View solution in original post

0 Karma

ITWhisperer
Ultra Champion

Have you looked at the case function?

View solution in original post

0 Karma

pduvofmr
Path Finder

Hi,

case works fine for me... thx

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!