how to write an "if" statement for a value in all the fields?

[mahbs]

Hi,

Is there a way of writing an if condition that basically says, "if value x exists in all of tabled fields, then create a new field, and insert the value "valid" into it".

Is that possible?

[micahkemp]

It sounds like you're asking that all fields present be equal to the same value (for my search that value will be rightvalue). If that is the case, you can use foreach to check the value of each field, and use some additional logic to accomplish what you are looking for. This run anywhere example shows this in action:

| makeresults 
| eval fieldA="wrongvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="wrongvalue"
| append [| makeresults | eval fieldA="rightvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="rightvalue"]
| fields - _time
| foreach * [eval validity=if((isnull(validity) or validity="valid") and <<FIELD>>="rightvalue", "valid", "invalid")]

If you need the new field to be null instead of "invalid", you could add | eval validity=if(validity="valid", validity, NULL)

[niketn]

@micahkemp, should the isnull(is_valid) be isnull(validity)?

[micahkemp]

Yes, thanks, and corrected above. I changed my field names after pasting the search into answers, and I missed that one. Annoyingly the incorrect search actually gave the correct results for those specific test cases.

[kamlesh_vaghela]

hi @mahbs,

Basically you can use Foreach command for search. Your search like below..

YOUR_SEARCH | eval valid="true" | foreach "*"  [ eval valid=if('<<FIELD>>'=="x","true","false") ] 

https://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Foreach

I hope this will help you.