How to create the Conditional search?

tcpcannon — Wed, 02 Aug 2023 19:46:54 GMT

I have looked through the forums and can't find exactly what I am looking for.

Here is my search and what I think should work, but I don't think I completely understand multisearch.

| multisearch [ search index=patch sourcetype=device host="bradley-lab" device_group=PRE* | where match(host,"bradley-lab")] [ search index=patch sourcetype=device host="bradley-lab" device_group=BFV* | where NOT match(host,"bradley-lab")] | dedup extracted_host | eval my_time=_time | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time) | rename extracted_host as device_Name, my_time as "Date Posted" | table "Date Posted" device_group device_Name current_system_version latest_system_version status

host=bradley-lab will come from a token drilldown on a dashboard

if the host is bradley-lab I want it to show all devices with the device_group=PRE
and if the host is anything else, I want it to show all devices with device_group=BFV

Re: Conditional search

ITWhisperer — Tue, 01 Aug 2023 21:30:42 GMT

Try something like this

index=patch sourcetype=device device_group=PRE* OR device_group=BFV* | where (match(host,"bradley-lab") AND searchmatch(device_group=PRE*)) OR (NOT match(host,"bradley-lab") AND searchmatch(device_group=BFV*)) | dedup extracted_host | eval my_time=_time | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time) | rename extracted_host as device_Name, my_time as "Date Posted" | table "Date Posted" device_group device_Name current_system_version latest_system_version status

topic Re: Conditional search in Splunk Search

How to create the Conditional search?

Re: Conditional search