rename everything not included in case()

[zkenaga]

I have eval category=case(false(),'category',like('test',"test_11%"),"11tests",like('test',"test_22%"),"22tests",like('test',"test33%"),"33tests",true(),'test') |

How would I say to rename everything else not included in case()?

Thanks.

[mengler_splunk]

Just to put the correct answer in writing:

eval category=case(false(),'category',like('test',"test_11%"),"11tests",like('test',"test_22%"),"22tests",like('test',"test33%"),"33tests",1==1,'everything_else')

[dorgra]

I'm a noob to Splunk and very interested in this question. As a programmer, why not nest the Case statement inside an IF statement?

[DalJeanis]

To amplify what @niketnilay said, wrapping an if around a case statement, in pretty much any language, is redundant. The only place it makes sense is in a few ancient languages where the switch/case/evaluate/whateveritwascalled statement is limited to numeric values and the if is not -- or by extension, where the main switch is based on conditionally jumping instructions due to different values of a single test, and you want the if to represent a different test.

[niketn]

@dorgra, I think the answer was including true() or 1==1 condition at the end of the case block, to handled everything else:

true(),"EverythingElse"

It is similar to default condition block when all the other conditions are not true.

[martin_mueller]

Do post what you did as an answer, and mark it as accepted.

[martin_mueller]

I'm confused - the "everything else" part of case() already is present in your example, the final pair: true(), 'test' yielding the value of the field test if all other tests are false.

What do you mean by rename?

PS: The first pair, false(), 'category', is pointless - false() is never true.

[zkenaga]

I figured it out after reading what you said more carefully... Thank you again

[zkenaga]

I apologize if I wasn't descriptive enough. I have 11tests and 22tests grouped together under a common name, what would be a way I could say, "for everything else, call it this"