topic Re: how to deal with the 2 conflict conditions on where in Splunk Search

how to deal with the 2 conflict conditions on where

jenniferhao — Mon, 12 Jul 2021 21:55:32 GMT

I have a query to send an alert, which have 2 conflict conditions:

|where alarm=1
generate some sum information only for alarm happens

|where alarm=0

do something for cleaning the alarm

|table *
But I only can do one of them, If I put where alarm=1 first, then I only can generate the alarm, otherwise, only can do clean alarm.

If I put where alarm=1 OR alarm=0, it cannot generate some sum information for the alarm data. For example |eventstats list(x) etc.

Any suggestion? Thanks in advance.

Re: how to deal with the 2 conflict conditions on where

renjith_nair — Tue, 13 Jul 2021 02:06:04 GMT

Please provide some sample events for better understanding your scenario.

In general, you should be able to do conditional stats

e.g

stats count(eval((field1 != field2)

Re: how to deal with the 2 conflict conditions on where

jenniferhao — Tue, 13 Jul 2021 15:02:16 GMT

Thanks.

The problem becomes how can get a list values with the condition? for example, I need to get some values lists where alarm=1, but I also need to deal with alarm=0

| where alarm=1 OR alarm=0

|eventstats list(create_session) as create_session list(Dn) as Dns by _time //ONLY alarm==1
|evenststa list (IPs) as IPs by _time //ONLY alarm==0

|table IPs create_session DNs