https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481213#M134848 <P>not sure why not search for all and then eliminate ....<BR /> something like this:</P> <PRE><CODE>index=* sourcetype=routes_devices OR sourcetype=router | table _time,host-name, reachability, name, sourcetype | eval result=if(reachability=="reachable",name,null()) | search result=* </CODE></PRE> <P>but maybe i am missing something</P> Wed, 18 Sep 2019 01:09:58 GMT adonio 2019-09-18T01:09:58Z https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481210#M134845 <P>Hello !</P> <P>Is there a way to do conditonal searches depending of the result of a first search ?<BR /> I mean, here is an exemple : <BR /> - A search command returns a table with a field containing an interesting value, for instance "reachable" or "not-reachable"<BR /> - a second search command is executed only if the value is "reachable" is set in the first command<BR /> - This second search should be run for each row of the table of the first command.</P> <P>In both commands, there are "eval" commands which are used for timestamp evaluations.<BR /> Here is a simplified version of my query :</P> <PRE><CODE>index=* sourcetype=routes_devices | table _time,host-name, reachability | eval result=if(reachability=="reachable", [search index=* sourcetype=router fields name], "NOK") </CODE></PRE> <P>Is it possible to that kind of searches ? with the best performance possible.<BR /> Thanks for your help !</P> Mon, 16 Sep 2019 06:34:48 GMT https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481210#M134845 julienlance 2019-09-16T06:34:48Z https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481211#M134846 <P>@julienlance ,</P> <P>Looking at your requirement, most probably <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map">map</A> command should work for you.<BR /> Apart from running the second search for each row, you can set a token in the first search for the desired search and use that token in the second search in map. So if the token is not set , then the second search will not run.</P> <P>e.g. <CODE>eval searchToken=case (reachability=="reachable",true())</CODE> </P> Mon, 16 Sep 2019 09:29:54 GMT https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481211#M134846 renjith_nair 2019-09-16T09:29:54Z https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481212#M134847 <P>Thanks you @renjith.nair, this is a great clue, I will try to use it !<BR /> Many thanks</P> Tue, 17 Sep 2019 16:50:21 GMT https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481212#M134847 julienlance 2019-09-17T16:50:21Z https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481213#M134848 <P>not sure why not search for all and then eliminate ....<BR /> something like this:</P> <PRE><CODE>index=* sourcetype=routes_devices OR sourcetype=router | table _time,host-name, reachability, name, sourcetype | eval result=if(reachability=="reachable",name,null()) | search result=* </CODE></PRE> <P>but maybe i am missing something</P> Wed, 18 Sep 2019 01:09:58 GMT https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481213#M134848 adonio 2019-09-18T01:09:58Z https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481214#M134849 <P>The eval command you specified doesn't work, as the token can't be a boolean (splunk said). <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Fri, 20 Sep 2019 13:34:09 GMT https://community.splunk.com/t5/Splunk-Search/Conditional-searches-in-the-same-search/m-p/481214#M134849 julienlance 2019-09-20T13:34:09Z