Splunk Search

If statement with AND

mansel_scheffel
Explorer

Hi,

Is it possible to use AND in an eval if statement.. for instance if(volume =10, "normal" if(volume >35 AND <40, "loud")) and so on.. I would like to add a few more if's into that as well..Any thoughts on how to structure it?

0 Karma
1 Solution

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

View solution in original post

javiergn
Super Champion

Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.
Why don't you use case instead?

eval whatever = case (
    volume = 10, "normal",
    volume > 35 AND volume < 40, "loud",
    1 = 1, "default rule"
)

hardikJsheth
Motivator

You can use case statement instead the syntax is
case (condition , TRUE, FALSE)

You can have nested case statements as well for eg.
|index=main | eval system=case(isnotnull(dest) AND dest!="unknown",dest,isnotnull(src) AND src!="unknown",src,isnotnull(dvc) AND dvc!="unknown",dvc,1=1,"unknown")

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...