what do when we get a error in Splunk eval command

Question

For this Splunk query:

index=* | eval case(status="200", "is successful", status="300", is redirect, status="400", "is error", 1=1", is did not match")

I expected that I would get a result with a list of 200 as successful & 300 is as redirect 400 as error, but my eval command as error

Answer 1

There appear to be a couple of issues with your use of the case statement.

1. You need to assign the result of the case statement to a field that can be used.

2. The quotes for your values are not correct. is redirect doesn't have any, and is did not match" has a trailing quote, but not a leading quote.

3. You should use == and not = when testing the status values.

4. You need to do something with the results of your case

Try something like this:

index=* 
| eval label = case(status=="200", "is successful", status=="300", "is redirect", status=="400", "is error", 1=1", "is did not match")
| stats count by label