topic Re: Search inside Eval if statement possible ? in Splunk Search

Search inside Eval if statement possible ?

crt89 — Thu, 17 Jan 2013 08:10:27 GMT

Is it possible to put search inside an eval if statement ? I am making a search that if the count of the field is greater than 1 it would display "Please check your query" then if its equal to 1 it will proceed to my search..

 eval test=if(count>1,"Please check query",count==1,*search command goes here*

Is the eval if statement the thing to use ?

Re: Search inside Eval if statement possible ?

jkat54 — Thu, 17 Jan 2013 14:08:13 GMT

Can you please give more details? It would help to know the rest of your search string and what search command you want to append to it, etc.

Re: Search inside Eval if statement possible ?

markthompson — Mon, 23 Feb 2015 14:09:55 GMT

The first point, is that the if statement only takes 3 arguments, if(condition, iftrue, iffalse).

Re: Search inside Eval if statement possible ?

vganjare — Thu, 09 Apr 2015 11:46:02 GMT

Hi,

You can try using join.

The query can have following logic:

eval test=if(count>1,"Please check query","JOIN_SEARCH") | join test [your custom search | eval test="JOIN_SEARCH"]

Please note, the additional variable "test" in subsearch is required to join the record with first search. So, for all the events where the condition ( count > 1 ) fails, test variable in first search will get value of "JOIN_SEARCH".

Thanks!!