topic Re: complex conditional search in Security

complex conditional search

intosplunk — Thu, 30 Jan 2025 07:49:39 GMT

Hey Splunkers,
I'm trying to create a conditional search that will run on the same index but will have different search terms according to a variable I have that can have one of three values.
It is supposed to be something like that:
index = my_index
variable = 1/2/3
if variable=1 then run search1
if variable=2 then run search2
if variable=3 then run search3

i tried multiple ways but they didn't work so im trying to get some help here😬

Re: complex conditional search

gcusello — Thu, 30 Jan 2025 07:54:05 GMT

Hi @intosplunk ,

let me understand: how do you set variable1/2/3: using a dropdown or based on a condition inside the search?

If based on a dropdown, you can insert the different searches in the dropdown values.

If based on a condition, you should share your searches to understand how to build your complex search.

Ciao.

Giuseppe

Re: complex conditional search

intosplunk — Thu, 30 Jan 2025 08:08:07 GMT

i just tried doing it in a dashboad and insert the different searches in a dropdown values and used the token after a search and it worked. thank you very much.