Is there any way I can tell eval if command to continue to next iteration if the current condition is false?

[nkankur]

|eval Column=if(<Condition>,Value<<MATCHSTR>>, Continue to next iteration)

It should jump to next comparison and do noting in the current condition?

Please help

[MonkeyK]

Also not sure what what you mean, but I'll make a couple of guesses.

If you are trying to affect the value of an existing column, sometimes I do it like this:

|eval Column=if(<Condition>,<new value>, Column)

That way, if the condition is not met, the original value is not affected. If the column that you are setting does not exist yet, and you do not want it to exist if not match, I think that could could try something like

|eval Column=if(<Condition>,<new value>, null())

[kamlesh_vaghela]

HI

I think eval case can help you.

YOUR_SEARCH | eval Column=(<Condition1>,Value1,<Condition2>,Value2,<Condition3>,Value3,...)

For more information see:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/ConditionalFunctions#case.28X...

Thanks

[gcusello]

Hi nkankur,
sorry but I don't understand: what do you mean with "Continue to next iteration"?
you put two values in the condition: the first when condition is true, the second when it's false,
when false you can put NULL or space (" ") or 0 and anyway you continue with the execution of eval command for the other events, at the same time output of eval command is used by the commands on the right, e.g.:

my_search
| eval Column=if(<Condition>,"OK", " " )
| search Column="OK"
| ...

Bye.
Giuseppe