topic Re: Search using IF statement in Splunk Search

Search using IF statement

tech_soul — Tue, 01 Oct 2019 07:48:01 GMT

Hi All,

Could you please help me with " if "query to search a condition is true then need to display some values from json format .
please i m brand new to splunk ..

Re: Search using IF statement

gcusello — Tue, 01 Oct 2019 08:00:30 GMT

Hi tech_soul,
without othe information is difficoult to help you! could you share more information?

Anyway, you can use the if condition in an eval command to set a variable to use for searches, for additioan information see https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/ConditionalFunctions .

E.g. if I want to set a value OK if a field has a value less than 100 and NOK if the value is more than 100, you could create a search like this:

index=my_index
| eval my_check=if(my_field>100,"NOK","OK")
| table _time my_check

Then you can use this value for additional conditions as search or where.

Bye.
Giuseppe

Re: Search using IF statement

yshen — Mon, 12 Oct 2020 23:05:55 GMT

Thanks for the concise example of if expression.

Re: Search using IF statement

LizAndy123 — Fri, 17 Jan 2025 00:26:21 GMT

I have a question

I Did this on an event and basically did the If command - that if above 15 mins then Output is BAD and if under 15 the. output is GOOD - This works.

My question is I now want to search only the BAD and alert - so guess how do I start another search after I have run eval and got my BAD output?

Re: Search using IF statement

richgalloway — Fri, 17 Jan 2025 01:16:51 GMT

FWIW, it's usually better to ask a new question than to pile on to a 4-year-old thread.

To keep only the BAD events, try one of these

index=my_index | eval my_check=if(my_field>100,"NOK","OK") | where my_check="NOK" | table _time my_check

index=my_index | where my_field>100 | table _time my_field