Splunk Search

eval if clarification

bonnlbbelandres
Path Finder

I have a document field that opens a document if available and it displays "no document found" if there is no document available.
But i want to add something to the document field.

i want to have a checkpoint that says pass or fail. If PASS, it should display either "document available" or "no document found"
if FAIL, it should display "Try again"

so im thinking,
is "eval if command" capable with this?

like

|eval document = if (checkpoint == "pass", ??? , "Try again")

i wanted to make that question mark the document field that displays "document available" or "no document found"

is it possible?

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

Yes you can do that similar to my example below:

In my example below, abc is the new variable I create. processState is another variable which will have active or ft, on which I am checking for status. Based on active status, I use another variable cpuUsage which will have more than one kind of value and get assigned to abc. If status is not active then I put "NA"

|eval abc=if(processState="active", cpuUsage, "NA")

So similarly you can make your own case which should work fine.

View solution in original post

gokadroid
Motivator

Yes you can do that similar to my example below:

In my example below, abc is the new variable I create. processState is another variable which will have active or ft, on which I am checking for status. Based on active status, I use another variable cpuUsage which will have more than one kind of value and get assigned to abc. If status is not active then I put "NA"

|eval abc=if(processState="active", cpuUsage, "NA")

So similarly you can make your own case which should work fine.

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...