topic Multiple operations from a single if condition in Splunk Search

Multiple operations from a single if condition

cjohnk — Wed, 12 Jun 2024 23:00:58 GMT

Is it possible to action multiple operations in a single if condition, like what can be done in other languages?

For example, in other scripting languages this can be done:

if(field==1){ group=group+1; groups=groups+","+group; } else { //this is a comment, do nothing }

How can this be done in splunk?

Re: Multiple operations from a single if condition

bowesmana — Wed, 12 Jun 2024 23:29:28 GMT

You can't do block ifs in Splunk, so you have to do all conditionals inside the | eval x=if(...) construct

Re: Multiple operations from a single if condition

ITWhisperer — Wed, 12 Jun 2024 23:31:14 GMT

Short answer is no.

Splunk SPL is not a procedural language (like some other languages). Essentially, the if function can be used to modify what is assigned by an eval command to a new or existing field in the event, although you can have multiple assignments in the same eval command e.g. | eval a=value1, b=value2

Re: Multiple operations from a single if condition

yuanliu — Thu, 13 Jun 2024 06:34:33 GMT

As @ITWhisperer and @bowesmana said, SPL is not a procedural language and does not provide code block. I do understand the semantic clarity, and maintainability of a code block. So, I am going to use the specifics in your sample to give a very silly "block".

Obviously I have no idea what values are in field, group and groups. So I made something up, with the constraint that group be numeric.

field	group	groups
0	10	10
1	20	30
2	30	60

The following will read like a block:

| eval bingo = if(field == 1, mvrange(group, group+1), null()) | foreach bingo mode=multivalue [eval group = <<ITEM>> + 1, groups = groups . "," . <<ITEM>>]

and the output is equivalent to your block code

field	group	groups
0	10	10
1	21	30,20
2	30	60

Is that code block? Not really. Does it achieve semantic clarity? Questionable. But you are not repeating condition evaluation.

Also, if maintainability is super important, you can also do something like

| tojson group groups | eval _raw = if(field == 1, json_set(_raw, "group", group + 1, "groups", groups . "," . group), _raw) | fields - group groups | spath

In a roundabout way, this has the true spirit of a code block.

The above mock data is produced with the following:

| makeresults format=csv data="field, group 0, 10 1, 20 2, 30" | streamstats sum(group) as groups ``` data emulation above ```