Splunk Search

using a variable with eval

hcastell
Path Finder

Yet another Newbie question, I have the following search string that's working fine:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < "57", "Pass", TestTxPwr >"57", "Fail")

However, the value of TestTxPwr can be two different values dependent upon what type of hardware I'm using. So I have added the following :

First eval defines the generation of the Boxtype then I wanted to do
| eval STB_Generation=case(BoxType="8642", "G6", BoxType="4642", "G6", BoxType="9865","G8")

Then I set a variable with the associated value that needs to be used for TestTxPwr

| eval stbGenSNRVAL=if(STB_Generation=="G6", 54, 57)

What I am wrestling with is trying to figure out how to pass the value of stbGenSNRVAL to the original eval string in place of the integer values noted in my example. So this would be something like:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

I know the above doesn't work but wanted to see if there was a way to accomplish my goal. I am certainly open to taking a completely different approach if there's a better way to do this. Hope the question is clear. Thanks in advance for your help.

Tags (2)
0 Karma
1 Solution

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

View solution in original post

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

hcastell
Path Finder

It works! Thanks for your help.

0 Karma

sk314
Builder

unless I read the question wrong, eval creates a field which you can use directly without enclosing them within %. (like you did in the eval stbGenSNRVAL statement)

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...