Splunk Search

using a variable with eval

hcastell
Path Finder

Yet another Newbie question, I have the following search string that's working fine:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < "57", "Pass", TestTxPwr >"57", "Fail")

However, the value of TestTxPwr can be two different values dependent upon what type of hardware I'm using. So I have added the following :

First eval defines the generation of the Boxtype then I wanted to do
| eval STB_Generation=case(BoxType="8642", "G6", BoxType="4642", "G6", BoxType="9865","G8")

Then I set a variable with the associated value that needs to be used for TestTxPwr

| eval stbGenSNRVAL=if(STB_Generation=="G6", 54, 57)

What I am wrestling with is trying to figure out how to pass the value of stbGenSNRVAL to the original eval string in place of the integer values noted in my example. So this would be something like:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

I know the above doesn't work but wanted to see if there was a way to accomplish my goal. I am certainly open to taking a completely different approach if there's a better way to do this. Hope the question is clear. Thanks in advance for your help.

Tags (2)
0 Karma
1 Solution

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

View solution in original post

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

hcastell
Path Finder

It works! Thanks for your help.

0 Karma

sk314
Builder

unless I read the question wrong, eval creates a field which you can use directly without enclosing them within %. (like you did in the eval stbGenSNRVAL statement)

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...