Splunk Search

using a variable with eval

hcastell
Path Finder

Yet another Newbie question, I have the following search string that's working fine:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < "57", "Pass", TestTxPwr >"57", "Fail")

However, the value of TestTxPwr can be two different values dependent upon what type of hardware I'm using. So I have added the following :

First eval defines the generation of the Boxtype then I wanted to do
| eval STB_Generation=case(BoxType="8642", "G6", BoxType="4642", "G6", BoxType="9865","G8")

Then I set a variable with the associated value that needs to be used for TestTxPwr

| eval stbGenSNRVAL=if(STB_Generation=="G6", 54, 57)

What I am wrestling with is trying to figure out how to pass the value of stbGenSNRVAL to the original eval string in place of the integer values noted in my example. So this would be something like:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

I know the above doesn't work but wanted to see if there was a way to accomplish my goal. I am certainly open to taking a completely different approach if there's a better way to do this. Hope the question is clear. Thanks in advance for your help.

Tags (2)
0 Karma
1 Solution

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

View solution in original post

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

hcastell
Path Finder

It works! Thanks for your help.

0 Karma

sk314
Builder

unless I read the question wrong, eval creates a field which you can use directly without enclosing them within %. (like you did in the eval stbGenSNRVAL statement)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...