How to add a query parameter conditionally?

mamerige — Wed, 05 Dec 2018 21:53:19 GMT

I'd like to conditionally add a parameter to my Splunk query based on the version number of my application.

I have an "uploadType" input that I want to use, but only for events where the app version is over a certain number because the old versions do not contains this field.

Something like:

if appVersion >= 10.0
then include uploadType=$uploadType$,
otherwise don't filter this field.

Is this possible?

Re: How to add a query parameter conditionally?

somesoni2 — Thu, 06 Dec 2018 06:10:02 GMT

Assuming you want to include the filters base search of your panels, you could do something like this

your base search (appVersion>=10.0 AND uploadType=$uploadType$) OR (appVersion<10.0) | rest of your search

topic How to add a query parameter conditionally? in Splunk Search

How to add a query parameter conditionally?

Re: How to add a query parameter conditionally?