Splunk Search

Help with If The Else Condition?

mmwells
Explorer

 am writing an If Then Else Evaluation statement and could use some help.

 

If (PRIORITY=02 AND Condition=Alarm) then <h3 style="color:red;">A Critical Alarm</h3>

else

If (PRIORITY=12 AND Condition=Alarm) then <h3 style="color:orange;">A High Alarm</h3>

else 

If (PRIORITY=22 OR PRIORITY=25 AND Condition=Alarm) then <h3 style="color:yellow;">A Low Alarm</h3>

else 

If (PRIORITY=02 OR PRIORITY=12 OR PRIORITY=22 OR PRIORITY=25 AND Condition=Clear) then <h3 style="color:green;">A Cleared Alarm</h3>

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can use a case function to evaluate the value of a field e.g.

| eval alarm=case(PRIORITY=02 AND Condition="Alarm","Critical",PRIORITY=12 AND Condition="Alarm","High",PRIORITY=22 OR PRIORITY=25 AND Condition="Alarm","Low",PRIORITY=02 OR PRIORITY=12 OR PRIORITY=22 OR PRIORITY=25 AND Condition="Clear","Cleared")

mmwells
Explorer

That is a start, but I need to be able to change the font color when a condition is met.

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...