topic Re: How to use IF....ELSE in Splunk in Splunk Search

How to use IF....ELSE in Splunk

Newbie_punk — Sun, 20 Aug 2023 01:24:18 GMT

Hello

I'm trying to figure out How can I use kinda if...else condition in my Splunk query.

I've set up two metrics, which are sending data to Splunk. Each matrix have different index value.
For Example: For Matrix A the index is "index=aData" and for Metric B index is "index=bData". Currently in Splunk I'm seeing duplicate data because both metrics are sending same value. So what I'm trying to achieve is:

1. First look for data if coming from "index=aData"
2. If able to see data from index "aData" show me the results
3. else check the data from "bData" (Not looking for "OR " condition)

Results should show the data only from 1 index to avoid duplicity.

Re: How to use IF....ELSE in Splunk

yuanliu — Sun, 20 Aug 2023 02:02:55 GMT

The best solution will depend on some other characteristics of the two datasets, and what exactly you plan to do with the surviving data. A generic approach, however, is to use exactly "OR". The idea is to retrieve all data, then retain data from one of indices. Suppose you REALLY want to present all raw data (instead of using stats for presentation), you can do

index IN (aData, bData) <other criteria> | eventstats values(index) as indices | where index = mvindex(indices, 0)

Re: How to use IF....ELSE in Splunk

ITWhisperer — Sun, 20 Aug 2023 08:16:50 GMT

Describing problems in generic terms is not always helpful as it just leads to more questions about what you are trying to do and with what.

For example, one way of interpreting what you have said could be resolved like this

<search indexA> | appendpipe [|stats count as _count | where _count = 0 | search indexB]

Re: How to use IF....ELSE in Splunk

gcusello — Sun, 20 Aug 2023 15:20:58 GMT

Hi @Newbie_punk,

SPL (Splunk Programming Language) isn't a procedural language, so you havent a construct like if then else.

But you can assign a value to a field based on the condition you defined, e.g.

if the same field has different name (e.g. metricA and metricB), you can use:

index=aData OR index=bData | eval metric=coalesce(metricA,metricB) | table metric

or use the if condition in the eval command

index=aData OR index=bData | eval metric=if(index=indexA,metricA,metricB) | table metric

Adapt ths approach to your condition.

Ciao.

Giuseppe