Splunk Search

Using AND in case() function

Paxxxman
Explorer

Hi all,

I'm currently trying to get the case() function working so that for each .csv file I have (which has information saved in the exact same format as the other, even though the information is pertaining to different things entirely) I can turn the information back into meaningful data.

Example - .csv files are named SHB_00X_[DATE].csv where X ranges from 1-8. Each of those .csv files bring in a value LANE, ranging from 1-3 or 1-4. However, the actual lanes in our system range from 1-19. So when I do a standard "stats count by LANE", I only get counts on lanes 1-4, but I need a count for 1-19.

So I tried to change the LANE name with the following case function:

eval RoadLane=case(source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="1", "17", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="2", "18", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="3", "19")

and the case() function goes on and on to sort out each lane by source AND lane. The search does not work at all. Any ideas why that is?

All help is appreciated! Thanks!

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

View solution in original post

hexx
Splunk Employee
Splunk Employee

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

Paxxxman
Explorer

Woops I didn't see that! Hahaha thanks again!

0 Karma

hexx
Splunk Employee
Splunk Employee

Glad to hear that! Please feel free to accept my answer 🙂

0 Karma

Paxxxman
Explorer

That did it! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...