Splunk Search

wrong results for case statement with AND

sam1010
Explorer

I used this eval statement with AND conditions but I'm only getting result as "Public" even when the condition satisfies for value "Private" i.e. I'm only getting default result. Any idea of what's wrong with this statement?

| eval perm=case(block_public_acls=true AND block_public_policy=true AND ignore_public_acls=true AND restrict_public_buckets=true,"Private",1=1,"Public")

sam1010_1-1634196686147.png

 

Labels (1)
0 Karma
1 Solution

marilyncugal
Engager

Check the type of the fields. 
e.g.  | eval type_of_field = typeof(block_public_acls)

If it is "String", then you can wrap the right side of the condition with quotation marks.

| eval perm=case(block_public_acls="true" AND block_public_policy="true" AND ignore_public_acls="true" AND restrict_public_buckets="true","Private",1=1,"Public")

View solution in original post

marilyncugal
Engager

Check the type of the fields. 
e.g.  | eval type_of_field = typeof(block_public_acls)

If it is "String", then you can wrap the right side of the condition with quotation marks.

| eval perm=case(block_public_acls="true" AND block_public_policy="true" AND ignore_public_acls="true" AND restrict_public_buckets="true","Private",1=1,"Public")

gcusello
SplunkTrust
SplunkTrust

Hi @sam1010,

use double quotes in all the conditions:

| eval perm=case(block_public_acls="true" AND block_public_policy="true" AND ignore_public_acls="true" AND restrict_public_buckets="true","Private",1=1,"Public")

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried putting "true" in double quotes?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...