Splunk Search

using a variable with eval

hcastell
Path Finder

Yet another Newbie question, I have the following search string that's working fine:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < "57", "Pass", TestTxPwr >"57", "Fail")

However, the value of TestTxPwr can be two different values dependent upon what type of hardware I'm using. So I have added the following :

First eval defines the generation of the Boxtype then I wanted to do
| eval STB_Generation=case(BoxType="8642", "G6", BoxType="4642", "G6", BoxType="9865","G8")

Then I set a variable with the associated value that needs to be used for TestTxPwr

| eval stbGenSNRVAL=if(STB_Generation=="G6", 54, 57)

What I am wrestling with is trying to figure out how to pass the value of stbGenSNRVAL to the original eval string in place of the integer values noted in my example. So this would be something like:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

I know the above doesn't work but wanted to see if there was a way to accomplish my goal. I am certainly open to taking a completely different approach if there's a better way to do this. Hope the question is clear. Thanks in advance for your help.

Tags (2)
0 Karma
1 Solution

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

View solution in original post

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

hcastell
Path Finder

It works! Thanks for your help.

0 Karma

sk314
Builder

unless I read the question wrong, eval creates a field which you can use directly without enclosing them within %. (like you did in the eval stbGenSNRVAL statement)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

.conf26 Registration is Live: Secure Your Early Bird Pass Now

  Lock in Your Spot: Registration Open for .conf26 in Denver Hello Splunkers, I have exciting news! Your ...

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update ...