Splunk Search

using a variable with eval

hcastell
Path Finder

Yet another Newbie question, I have the following search string that's working fine:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < "57", "Pass", TestTxPwr >"57", "Fail")

However, the value of TestTxPwr can be two different values dependent upon what type of hardware I'm using. So I have added the following :

First eval defines the generation of the Boxtype then I wanted to do
| eval STB_Generation=case(BoxType="8642", "G6", BoxType="4642", "G6", BoxType="9865","G8")

Then I set a variable with the associated value that needs to be used for TestTxPwr

| eval stbGenSNRVAL=if(STB_Generation=="G6", 54, 57)

What I am wrestling with is trying to figure out how to pass the value of stbGenSNRVAL to the original eval string in place of the integer values noted in my example. So this would be something like:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

I know the above doesn't work but wanted to see if there was a way to accomplish my goal. I am certainly open to taking a completely different approach if there's a better way to do this. Hope the question is clear. Thanks in advance for your help.

Tags (2)
0 Karma
1 Solution

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

View solution in original post

jimodonald
Contributor

I agree with sk314, you should not need the "%" surrounding the variables. This:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < %stbGenSNRVal%, "Pass", TestTxPwr >%stbGenSNRVal%, "Fail")

Should be this:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr < stbGenSNRVal, "Pass", TestTxPwr > stbGenSNRVal , "Fail")

hcastell
Path Finder

It works! Thanks for your help.

0 Karma

sk314
Builder

unless I read the question wrong, eval creates a field which you can use directly without enclosing them within %. (like you did in the eval stbGenSNRVAL statement)

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...