topic Re: How can I use an if or eval statement to run a custom search command in Splunk Search

How can I use an if or eval statement to run a custom search command

splunker1981 — Tue, 14 Nov 2017 00:47:26 GMT

Hello Splunkers -

Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts?

| eval valueToTest=if(isnotnull(statementHere),0,1)
| if (1 do customCommand1)
| if (0 do customCommand2)

Re: How can I use an if or eval statement to run a custom search command

MuS — Tue, 14 Nov 2017 00:50:22 GMT

As far as I know this is still not possible out of the box, but you could put the logic into your custom command instead.

cheers, MuS

Re: How can I use an if or eval statement to run a custom search command

DalJeanis — Tue, 14 Nov 2017 21:13:03 GMT

Try something like this...

  | eval valueToTest=if( your test here ,1,2)
  | appendpipe [ | where valueToTest==1 | do customCommand1 | eval rectype="1"]
  | appendpipe [ | where valueToTest==2 | do customCommand2 | eval rectype="2"]
  | where isnotnull(rectype)

Re: How can I use an if or eval statement to run a custom search command

splunker1981 — Thu, 16 Nov 2017 17:08:18 GMT

This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?