https://community.splunk.com/t5/Splunk-Search/Functions-in-splunk-query-language/m-p/79547#M20140 <P>Splunk's search language is extremely flexible. There are a number of commands out-of-the-box such as "| eval" and "| transaction". If you find something that can't be done using a shipped command, Splunk gives the ability to create your own search command using python.</P> <P>See: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual">Search Reference</A></P> Fri, 15 Apr 2011 18:52:12 GMT hazekamp 2011-04-15T18:52:12Z https://community.splunk.com/t5/Splunk-Search/Functions-in-splunk-query-language/m-p/79546#M20139 <P>Is it possible to create functions in the splunk query language? Right now I am working to try and correlate call detail records for a telephony platform. Essentially every call can generate N records, where N is determined by the type of call, features invoked, etc. To correlate the records correctly, it would be awesome if I could have some sort of branching ability based on the values of fields. Something along these lines:</P> <PRE><CODE>if(service_provider==wdv_trunking,(true search query),(false search query))? </CODE></PRE> Tue, 12 Apr 2011 20:58:16 GMT https://community.splunk.com/t5/Splunk-Search/Functions-in-splunk-query-language/m-p/79546#M20139 msarro 2011-04-12T20:58:16Z https://community.splunk.com/t5/Splunk-Search/Functions-in-splunk-query-language/m-p/79547#M20140 <P>Splunk's search language is extremely flexible. There are a number of commands out-of-the-box such as "| eval" and "| transaction". If you find something that can't be done using a shipped command, Splunk gives the ability to create your own search command using python.</P> <P>See: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual">Search Reference</A></P> Fri, 15 Apr 2011 18:52:12 GMT https://community.splunk.com/t5/Splunk-Search/Functions-in-splunk-query-language/m-p/79547#M20140 hazekamp 2011-04-15T18:52:12Z