eval function splunk

[disha]

In my search I need functionality like
My search...| if eventid=1 then "table a,b,c",if eventid=2 then "table c,d",if eventid =3 then "table p,q,r,s"
I tried eval case..but I am getting syntax error or it is not giving required output.
Please help.
Thanks.

[lguinn2 · Accepted solution]

The results of if statements and eval statements cannot be commands. So, to take jcoates answer a step further:

Assume that you have the fields a b c d p q r s. Then, do this

yoursearchhere
| table eventid a b c d p q r s

I don't think that you actually need the fillnull, although it shouldn't hurt.

Of course, this table will have field headers that may be empty. It's a little complicated, but you could do this

yoursearchhere
| eval list = case(eventid=="1", a + "\t" + b + "\t" + c,
                          eventid=="2", c + "\t" + d
                          eventid=="3", p + "\t" + q + "\t" + r+ "\t" + s)
| table list

BTW, I am hoping that "\t" will translate to the tab character. I haven't actually tried that part.

[disha]

Thankyou So much.

[jcoates_splunk]

Hard to say without data, but I think you might be needing fillnull. I think that $mysearch needs to return everything that might be needed, so try putting fillnull value=NULL a b c d p q r s before the evals?