nested if loop in splunk

I would like to write in splunk a nested if loop: What I want to achieve

if buyer_from_France: do eval percentage_fruits if percentage_fruits> 10: do summation if summation>20: total_price if total_price>$50: do(trigger bonus coupon) 

My current code (that works):

> | eventstats sum(buyers_fruits) AS total_buyers_fruits by location > | stats sum(fruits) as buyers_fruits by location buyers > | eval percentage_fruits=fruits_bought/fruits_sold > | table fruits_bought fruits_sold buyers > | where percentage_fruits > 10 > | sort - percentage_fruits 

How do I complete the syntax/expression for the 2nd (summation) and consequently, 3rd (total price), 4th if-loop (trigger)?

1 Answer

SPL doesn't do "loops". A close [enough] analog is that each line in SPL is similar to a single command in bash (hence the pipe separator between commands). IOW, SPL is purely linear in processing. Use a multi-condition eval..if like this:

index=ndx sourcetype=srctp | eval myfield=if(match(fieldA,"someval") AND !match(fieldC,"notthis"),"all true","else val") 

Or like this:

| eval myfield=if(match(fieldA,"someval"),if(match(fieldB,"otherval"),"matched A&B",if(!match(fieldC,"notthis"),"not A & not C","else val"))) 

If you can explain your use case/end goal better, we can probably provide better direction