Splunk Search

eval function splunk

disha
Contributor

In my search I need functionality like
My search...| if eventid=1 then "table a,b,c",if eventid=2 then "table c,d",if eventid =3 then "table p,q,r,s"
I tried eval case..but I am getting syntax error or it is not giving required output.
Please help.
Thanks.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

The results of if statements and eval statements cannot be commands. So, to take jcoates answer a step further:

Assume that you have the fields a b c d p q r s. Then, do this

yoursearchhere
| table eventid a b c d p q r s

I don't think that you actually need the fillnull, although it shouldn't hurt.

Of course, this table will have field headers that may be empty. It's a little complicated, but you could do this

yoursearchhere
| eval list = case(eventid=="1", a + "\t" + b + "\t" + c,
                          eventid=="2", c + "\t" + d
                          eventid=="3", p + "\t" + q + "\t" + r+ "\t" + s)
| table list

BTW, I am hoping that "\t" will translate to the tab character. I haven't actually tried that part.

View solution in original post

lguinn2
Legend

The results of if statements and eval statements cannot be commands. So, to take jcoates answer a step further:

Assume that you have the fields a b c d p q r s. Then, do this

yoursearchhere
| table eventid a b c d p q r s

I don't think that you actually need the fillnull, although it shouldn't hurt.

Of course, this table will have field headers that may be empty. It's a little complicated, but you could do this

yoursearchhere
| eval list = case(eventid=="1", a + "\t" + b + "\t" + c,
                          eventid=="2", c + "\t" + d
                          eventid=="3", p + "\t" + q + "\t" + r+ "\t" + s)
| table list

BTW, I am hoping that "\t" will translate to the tab character. I haven't actually tried that part.

disha
Contributor

Thankyou So much.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hard to say without data, but I think you might be needing fillnull. I think that $mysearch needs to return everything that might be needed, so try putting fillnull value=NULL a b c d p q r s before the evals?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...