![splunk where splunk where](https://prod.cdn.apps.splunk.com/media/public/screenshots/cf285b8a-e414-11eb-a424-02c13fb04365.png)
Shallow-focus earthquakes occur at depths less than 70 km.
![splunk where splunk where](https://i.pinimg.com/originals/fb/8a/f1/fb8af1038720edab7c190ae7120e8563.png)
You want classify earthquakes based on depth. The data is a comma separated ASCII text file that contains magnitude (mag), coordinates (latitude, longitude), region (place), and so forth, for each earthquake recorded. This example uses earthquake data downloaded from the USGS Earthquakes website.
Splunk where how to#
This example shows you how to use the case function in two different ways, to create categories and to create a custom sort order.
![splunk where splunk where](https://cdn.apps.splunk.com/media/public/screenshots/6accc54e-10f4-11ea-8f51-06bb9b59dd04.png)
The word Other displays in the search results for status=406 and status=408. | eval description=case(status = 200, "OK", status =404, "Not found", status = 500, "Internal Server Error", true, "Other") To display a default value when the status does not match one of the values specified, use the literal true. In the above example, the description column is empty for status=406 and status=408. | eval description=case(status = 200, "OK", status =404, "Not found", status = 500, "Internal Server Error") |from my_dataset where sourcetype="access_*" The following example returns descriptions for the corresponding HTTP status code. You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. The function defaults to NULL if none of the arguments are true. When the first expression is encountered that evaluates to TRUE, the corresponding argument is returned. The arguments are Boolean expressions that are evaluated from first to last. This function takes pairs of and arguments and returns the first value for which the condition evaluates to TRUE. The following list contains the functions that you can use to compare values or specify conditional statements.įor information about using string and numeric fields in functions, and nesting functions, see Overview of SPL2 evaluation functions.