Splunk Search

help with eval command

super_saiyan
Communicator

Hi everyone, i want to use the below command in a single line. i have tried "comma" but it's not working.

How do i do it?

|eval comments= if(Action="create","something has been created",'comments')
|eval comments= if(Action="delete","something  has been deleted",'comments')


Thanks.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @super_saiyan,

yes sorry!

| eval comments= if(Action="create","something has been created", if(Action="delete","something  has been deleted",'comments'))

does it run and solves your need?

Ciao.

Giuseppe

View solution in original post

somesoni2
Revered Legend

Use the case command, like this

|eval comments= case(Action="create","something has been created", Action="delete","something  has been deleted", true(),'comments')

The option "true()" is for default option (when all preceding conditions do not match).

gcusello
SplunkTrust
SplunkTrust

Hi @super_saiyan,

use two concatenated ifs:

| eval comments= if(Action="create","something has been created", if(Action="delete","something  has been deleted",'comments')

or case with the same logic

Ciao.

Giuseppe

super_saiyan
Communicator

There is a closing bracket " ) " missing in the SPL.
is it supposed to be that way ? 
@gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @super_saiyan,

yes sorry!

| eval comments= if(Action="create","something has been created", if(Action="delete","something  has been deleted",'comments'))

does it run and solves your need?

Ciao.

Giuseppe

super_saiyan
Communicator

Yes, It ran and solved my issue. Thank you so much as always.
@gcusello 

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...