Splunk Search

eval function splunk

disha
Contributor

In my search I need functionality like
My search...| if eventid=1 then "table a,b,c",if eventid=2 then "table c,d",if eventid =3 then "table p,q,r,s"
I tried eval case..but I am getting syntax error or it is not giving required output.
Please help.
Thanks.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

The results of if statements and eval statements cannot be commands. So, to take jcoates answer a step further:

Assume that you have the fields a b c d p q r s. Then, do this

yoursearchhere
| table eventid a b c d p q r s

I don't think that you actually need the fillnull, although it shouldn't hurt.

Of course, this table will have field headers that may be empty. It's a little complicated, but you could do this

yoursearchhere
| eval list = case(eventid=="1", a + "\t" + b + "\t" + c,
                          eventid=="2", c + "\t" + d
                          eventid=="3", p + "\t" + q + "\t" + r+ "\t" + s)
| table list

BTW, I am hoping that "\t" will translate to the tab character. I haven't actually tried that part.

View solution in original post

lguinn2
Legend

The results of if statements and eval statements cannot be commands. So, to take jcoates answer a step further:

Assume that you have the fields a b c d p q r s. Then, do this

yoursearchhere
| table eventid a b c d p q r s

I don't think that you actually need the fillnull, although it shouldn't hurt.

Of course, this table will have field headers that may be empty. It's a little complicated, but you could do this

yoursearchhere
| eval list = case(eventid=="1", a + "\t" + b + "\t" + c,
                          eventid=="2", c + "\t" + d
                          eventid=="3", p + "\t" + q + "\t" + r+ "\t" + s)
| table list

BTW, I am hoping that "\t" will translate to the tab character. I haven't actually tried that part.

disha
Contributor

Thankyou So much.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hard to say without data, but I think you might be needing fillnull. I think that $mysearch needs to return everything that might be needed, so try putting fillnull value=NULL a b c d p q r s before the evals?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...