Splunk Search

how to assign boolean result within eval?

Contributor

hi,

I worked last week with Splunk 6.3.3 and upgraded to the latest version 6.5.

I detected a problem with a search, when i try to assign a boolean result using eval function.
on the Splunk 6.3.3, it worked but not with 6.5

this is my request :

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, country="FR", country!="FR")

the tokenValue get a dynamic value 0 or 1.
how can i search or filter my events based on tokenValue?

here's a picture of the error message.

thx
alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

How about this?

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0))
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

How about this?

|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0))
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!