Splunk Search

how to assign boolean result within eval?

sfatnass
Contributor

hi,

I worked last week with Splunk 6.3.3 and upgraded to the latest version 6.5.

I detected a problem with a search, when i try to assign a boolean result using eval function.
on the Splunk 6.3.3, it worked but not with 6.5

this is my request :

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, country="FR", country!="FR")

the tokenValue get a dynamic value 0 or 1.
how can i search or filter my events based on tokenValue?

here's a picture of the error message.

thx
alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

How about this?

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How about this?

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0))
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...