Hi everyone,
I am attempting to implement some logic in my alert searches but I can't seem to figure out how to do it.
I have some event data coming into Splunk that I want to trigger a Service Now incident creation using a priority value based on the event severity and the host environment (test, stage, prod, DR).
I am using a case statement to assign a severity ID depending on the alert severity:
| eval severity_id=case(Severity=="critical", 6, Severity=="major", 5, 1==1, 3)
If I want to add a second condition to check the value of the hostEnvironment field before setting the severity ID what would be the best way to do this?
E.G. If the severity = "critical" AND hostEnvironment = test then severity ID = 3.
E.G. If the severity = "critical" AND hostEnvironment = prod then severity ID = 6
etc.
I am hoping there is a way to nest the comparison functions.
Thanks in advance.
You don't have to nest the conditionals. You can just use the same statements as in your explanation.
| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)
To nest conditional just put another case or if function in place of the value clause.
| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)
Or an easier to read version:
| eval severity_id=case(
Severity=="critical",
case(hostEnvironment="prod", 6,
hostEnvironment="test", 3,
1==1, 3),
Severity=="major", 5,
1==1, 3)
You don't have to nest the conditionals. You can just use the same statements as in your explanation.
| eval severity_id=case(Severity=="critical" AND hostEnvironment ="prod", 6, Severity=="critical" AND hostEnvironment ="test", 3, Severity=="major", 5, 1==1, 3)
To nest conditional just put another case or if function in place of the value clause.
| eval severity_id=case(Severity=="critical", case(hostEnvironment="prod", 6, hostEnvironment="test", 3, 1==1, 3), Severity=="major", 5, 1==1, 3)
Or an easier to read version:
| eval severity_id=case(
Severity=="critical",
case(hostEnvironment="prod", 6,
hostEnvironment="test", 3,
1==1, 3),
Severity=="major", 5,
1==1, 3)
Thank you very much for this richgalloway!
This worked perfectly.