topic Re: Conditional Searches in Splunk Search

How to do Conditional Searches?

secphilomath — Thu, 05 May 2022 16:24:35 GMT

Is there a way to do a search like this;

If Eventid=1111

only do these statements

elseif Eventid=2222

only do these statements

elseif eventid=3333

only do these statements

Do these extra statements ...

bowesmana — Wed, 04 May 2022 23:28:03 GMT

You can do if logic in eval statements, but there is no "if" block. It will depend on what you want to do in those conditions.

You can often achieve if type logic, can you give an example of the sort of actions you want to take.

secphilomath — Thu, 05 May 2022 15:03:09 GMT

Essentially I want to run 3 different search commands depending on the value of the eventid.

VatsalJagani — Thu, 05 May 2022 16:02:39 GMT

@secphilomath - Not sure what is your goal exactly but based on what you have described, you can try appendpipe command.

I hope this helps!!!