Splunk Search

Could anyone explain what the below eval condition is doing my search?

pavanae
Builder

The following is the search in my Splunk. Now I am just trying to understand the structure and that condition means could anyone please explain the below?

my search | eval risk_rating=case('tag::eventtype'="Black","Black", 'tag::eventtype'="White","White", 'tag::eventtype'="Red","Red", 1==1, "Yellow")
1 Solution

woodcock
Esteemed Legend

For each event/row, it creates a new field named risk_rating whose value is set depending on the value of another field, in this case the tag::eventtype. If the value is defined, it copies it as-is, if it is undefined, it sets the value to "Yellow". Because 3 values are blind copying plus a default, the developer should have used coalesce instead of case, like this:

... | eval risk_rating=coalesce(tag::eventtype, "Yellow")

Also, the best way to end the last test in a case statement (the default) is to use true(), instead of 1==1.

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@pavanae - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

For each event/row, it creates a new field named risk_rating whose value is set depending on the value of another field, in this case the tag::eventtype. If the value is defined, it copies it as-is, if it is undefined, it sets the value to "Yellow". Because 3 values are blind copying plus a default, the developer should have used coalesce instead of case, like this:

... | eval risk_rating=coalesce(tag::eventtype, "Yellow")

Also, the best way to end the last test in a case statement (the default) is to use true(), instead of 1==1.

niketn
Legend

case is like switch statement to set the value of risk_rating...

tag::eventytpe=="Black" then set risk_rating as Black
Similarly for White and Red

1==1 is like the default case which sets everything else to Yellow.

Similar result can be achieved with cascaded if in Splunk, however it gets confusing with more conditions being checked.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

On the quick overlook, if your base search return events which matches the tag defined for eventtype, the name of eventtype of the event is set in the risk_rating. If an event doesn't have a tag defined, the risk_rating is set to a default value of "Yellow".

A good explanation of tag and eventtype is available here
https://answers.splunk.com/answers/238355/what-are-the-definitions-of-tag-and-eventtype-and.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...