Splunk Search

eval if clarification

bonnlbbelandres
Path Finder

I have a document field that opens a document if available and it displays "no document found" if there is no document available.
But i want to add something to the document field.

i want to have a checkpoint that says pass or fail. If PASS, it should display either "document available" or "no document found"
if FAIL, it should display "Try again"

so im thinking,
is "eval if command" capable with this?

like

|eval document = if (checkpoint == "pass", ??? , "Try again")

i wanted to make that question mark the document field that displays "document available" or "no document found"

is it possible?

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

Yes you can do that similar to my example below:

In my example below, abc is the new variable I create. processState is another variable which will have active or ft, on which I am checking for status. Based on active status, I use another variable cpuUsage which will have more than one kind of value and get assigned to abc. If status is not active then I put "NA"

|eval abc=if(processState="active", cpuUsage, "NA")

So similarly you can make your own case which should work fine.

View solution in original post

gokadroid
Motivator

Yes you can do that similar to my example below:

In my example below, abc is the new variable I create. processState is another variable which will have active or ft, on which I am checking for status. Based on active status, I use another variable cpuUsage which will have more than one kind of value and get assigned to abc. If status is not active then I put "NA"

|eval abc=if(processState="active", cpuUsage, "NA")

So similarly you can make your own case which should work fine.

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...