Here's some info from the Splunk docs: http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConditionalFunctions
Description:This function takes pairs of arguments X and Y. The X arguments are Boolean expressions that are evaluated from first to last. When the first X expression is encountered that evaluates to TRUE, the corresponding Y argument is returned. The function defaults to NULL if none are true.
Usage: You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
The following example returns descriptions for the corresponding http status code.
... | eval description=case(error ==404, "Not found", error == 500,
"Internal Server Error", error == 200, "OK")
From a cursory glance and without being a Splunk expert (I'm a community post moderator), it does look like the syntax is off where X should be without quotes and y should have quotes: case(X,"Y",...)
Hope that helps! I added some tags for more expert visibility too. 🙂
... View more
it didn't work. I figured it out. Here is the answer.
index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")
... View more