topic Re: If else conditional search returning table in Splunk Search

If else conditional search returning table

neerajs_81 — Mon, 18 Oct 2021 10:05:02 GMT

Hello, i need to configure a search using If else condition but the search outputs in a table format. Can someone please assist ?

Original snippet of the search :

index=index1 sourcetype=index1:xyz eventName IN( GetAction, PutAction,ModifyAction) | [Search...]

Requirement : Separate using IF-else as follows:

index=index1 sourcetype=xyz IF eventName in ( PutAction, GetAction) then [ run search 1 ] else if eventName in (ModifyAction ) then [run search 2]

Please note both search1 and 2 returns results in Table format.

Re: If else conditional search returning table

ITWhisperer — Mon, 18 Oct 2021 10:21:02 GMT

search 1 | where eventName="GetAction" OR eventName="PutAction" | append [search 2 | where eventName="ModifyAction"]

Re: If else conditional search returning table

neerajs_81 — Mon, 18 Oct 2021 11:13:05 GMT

Thank you for responding. The search is taking forever to complete if i put where condition towards the end as you mentioned.
On the other hand, if i use eventName IN ( ) at the beginning, the search completes much faster.

Re: If else conditional search returning table

ITWhisperer — Mon, 18 Oct 2021 11:17:34 GMT

The problem with your question is that there is not enough detail about how the different searches and events returned by those searches relate to each other. Without this sort of detail, it is difficult to suggest something which might help.

Re: If else conditional search returning table

neerajs_81 — Mon, 18 Oct 2021 11:18:30 GMT

I will DM you. Thanks