topic Re: Is it possible to call lookup within case statement? in Splunk Search

Is it possible to call lookup within case statement?

RSS_STT — Tue, 12 Mar 2024 09:05:12 GMT

I want to call lookup within case statement. if possible, please share sample query.

Re: Is it possible to call lookup within case statement?

ITWhisperer — Tue, 12 Mar 2024 09:10:31 GMT

The simple answer is no - what is your usecase? what are you trying to achieve? There may be another way

Re: Is it possible to call lookup within case statement?

bowesmana — Tue, 12 Mar 2024 09:15:48 GMT

Yes you can using the lookup eval command

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/ConditionalFunctions#lookup.28.26lt.3Blookup_table.26gt.3B.2C.26lt.3Bjson_object.26gt.3B.2C.26lt.3Bjson_array.26gt.3B.29

It has to come from a CSV, you cannot use KV store lookups

Re: Is it possible to call lookup within case statement?

ITWhisperer — Tue, 12 Mar 2024 09:28:37 GMT

Good point - not easy to use in a case statement though

Re: Is it possible to call lookup within case statement?

RSS_STT — Tue, 12 Mar 2024 09:39:47 GMT

I have fields aa, bb, cc, dd, hostname and sometime few filed value may be null in payload.

What i want to do.

if (aa, bb is not null) than lookup abc.csv name output name hostname ip

if (cc, dd is not null) than lookup abc.csv name output name hostname ip

if hostname=echo than lookup abc.csv name output name hostname ip

Here is the catch, if 1st if condition is executed it should ignore 2nd & 3rd.

if 2nd if statement executed than 3rd should ignored. Like wise i have to go upto 10 if condition.

Re: Is it possible to call lookup within case statement?

ITWhisperer — Tue, 12 Mar 2024 10:37:07 GMT

Since all the lookups appear to be the same, why not do the lookup first, then evaluate (with your conditions) whether the results are worth keeping?

Re: Is it possible to call lookup within case statement?

bowesmana — Wed, 13 Mar 2024 00:09:56 GMT

True enough - it's fiddly and requires post processing of the JSON output, but it's one of the rare conditional if/execute pieces of powerful logic in SPL