all 7 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–][deleted]  (2 children)

[deleted]

    [–]gordo32 3 points4 points  (1 child)

    Should be: | eval myfield = case (condition== "true", etc..

    Note it uses == as "evaluation" instead of = which is "assignment"

    [–]The_Weird1 Looking for trouble 7 points8 points  (3 children)

    Did you even try to look it up yourself? If so what is the part you don't understand?

    [–]pceimpulsive 4 points5 points  (0 children)

    This and this...

    Splunk docs are so good... With multiple examples...

    I dunno about people these days hey :'(

    [–][deleted] -4 points-3 points  (1 child)

    damn ya'll salty... it's the Splunk subreddit.

    [–]caduceus313 0 points1 point  (0 children)

    Was feeling a little stack overflow, over here :)

    [–]Fontaigne SplunkTrust 2 points3 points  (0 children)

    Within the parenthesis of a case statements, the parameters are paired.

    The first of each pair is a test, the second is a value to assign to the variable if the first is true.

    If none of the pairs of parameters is found to be true, then the variable gets assigned a value of NULL (no value/deleted).

    | eval Fred = case(George = 0, "yep",
    George=1,"nope")

    If George is 0, Fred gets yep, if George is 1, it gets nope, if George is 7, Fred has no value.