Splunk Search

How to modify output based on condition applied to each rows

ibob0304
Communicator

I have a query that output below, Status column is generated based on if condition.

|eval Status = if(Quantity>10,Good,BAD)

Output

Name           Quantity           Status
pen                20              Good    
book               13              Good
riddle             2               Bad
note               60              Good

Is it possible to apply if or any other conditions to each row ? like if pen Quantity is more than 1 then say Good,
if book Quantity is less than 10 is Bad ?. In short, applying conditions to each row instead of applying at one column level.

0 Karma
1 Solution

mayurr98
Super Champion

Yes you can are caseif you are looking for applying conditions to each row

You can try something like

...|eval Status=case(Name="pen" AND Quantity>1,"Good",Name="book" AND Quantity<10,"Bad")

In this way you can add condition for other rows as well i.e. for riddle note and so on.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Yes you can are caseif you are looking for applying conditions to each row

You can try something like

...|eval Status=case(Name="pen" AND Quantity>1,"Good",Name="book" AND Quantity<10,"Bad")

In this way you can add condition for other rows as well i.e. for riddle note and so on.

let me know if this helps!

ibob0304
Communicator

That worked.. Thank you

0 Karma

493669
Super Champion

You can try like:

...|eval Status=if (Name="pen" AND Quantity >1 ,"Good", "Bad")
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...