Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Eval New Field and If statement

$
0
0
Hi, I wonder whether someone may be able to help me please. I'm trying to run a query which looks at a value in column A (detail.overall) and if they contain specific values insert a specific value into the "Rating" column or zero. So if the detail.overall column is: Very Satisfied - Insert the value of 100 in the "Ratings" Column Satisfied - Insert the value of 75 in the "Ratings" Column Neither - Insert the value of 50 in the "Ratings" Column Dissatisfied - Insert the value of 25 in the "Ratings" Column Very Dissatisfied - Insert the value of 0 in the "Ratings" Column If none of the values are found I'd like to insert a zero. This is the query I've put together so far: index=main auditSource=frontend auditType=Survey detail.overall!="None" | replace frontend with "Overall Satisfaction" | replace 1 with "Very Satisfied", 2 with "Satisfied", 3 with "Neither", 4 with "Dissatisfied", 5 with "Very Dissatisfied" | chart count by detail.overall | addcoltotals|fillnull value="Total" count | eval Rating = if(match(detail.overall, "5"), "100", "0") There a two problems I have: [] Using the value "Very Satisfied" I'm unable to insert the value of 100 in the "Ratings" column [] I'm unsure how to create a nested if statement to take into all of the text values. I just wondered whether someone may be able to look at this please and offer some guidance on how I may be able to acheive this. Many thanks and kind regards Chris

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>