Splunk Search

Using AND in case() function

Paxxxman
Explorer

Hi all,

I'm currently trying to get the case() function working so that for each .csv file I have (which has information saved in the exact same format as the other, even though the information is pertaining to different things entirely) I can turn the information back into meaningful data.

Example - .csv files are named SHB_00X_[DATE].csv where X ranges from 1-8. Each of those .csv files bring in a value LANE, ranging from 1-3 or 1-4. However, the actual lanes in our system range from 1-19. So when I do a standard "stats count by LANE", I only get counts on lanes 1-4, but I need a count for 1-19.

So I tried to change the LANE name with the following case function:

eval RoadLane=case(source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="1", "17", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="2", "18", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="3", "19")

and the case() function goes on and on to sort out each lane by source AND lane. The search does not work at all. Any ideas why that is?

All help is appreciated! Thanks!

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

View solution in original post

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

Paxxxman
Explorer

Woops I didn't see that! Hahaha thanks again!

0 Karma

hexx
Splunk Employee
Splunk Employee

Glad to hear that! Please feel free to accept my answer 🙂

0 Karma

Paxxxman
Explorer

That did it! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...