https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703187#M238362 <P>Why don't you try with macros and if, case statement?&nbsp;</P> Wed, 30 Oct 2024 18:03:16 GMT alexandarmatev1 2024-10-30T18:03:16Z https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703132#M238358 <P>I have two query in splunk query 1 and query 2 and an input. Based on the input, i need to execute either query 1 or query 2. I am trying something like below query but it is not working for me.<BR /><BR /></P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval myInput="*" | append [ search "my search related to query 1" | rex field=_raw "Job id : (?&lt;job_id&gt;[^,]+)" | where myInput="*" | eval query_type="query1" | table job_id, query_type, myInput ] | append [ search "my search related to query 2" | rex field=_raw "Job id : (?&lt;job_id&gt;[^,]+)" | where myInput!="*" | eval query_type="query2" | table job_id, query_type, myInput ]</LI-CODE><P>&nbsp;</P><P><BR /><BR /><BR /></P> Wed, 30 Oct 2024 14:46:58 GMT https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703132#M238358 taruntalreja 2024-10-30T14:46:58Z https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703148#M238360 <LI-CODE lang="markup">| makeresults | eval myInput="*" | append [ | search "my search related to query 1" | rex field=_raw "Job id : (?&lt;job_id&gt;[^,]+)" | eval query_type=if(myInput="*", "query1", null()) | where query_type="query1" | table job_id, query_type, myInput ] | append [ | search "my search related to query 2" | rex field=_raw "Job id : (?&lt;job_id&gt;[^,]+)" | eval query_type=if(myInput!="*", "query2", null()) | where query_type="query2" | table job_id, query_type, myInput ]</LI-CODE> Wed, 30 Oct 2024 16:54:37 GMT https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703148#M238360 alexandarmatev1 2024-10-30T16:54:37Z https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703151#M238361 <P>This solution does not work, I am getting empty result. I think there is an issue and myInput variable is not passed in append. One more issue with this solution is that both the queries will be running but we know beforehand which query to run, so I am looking for some optimized solution where only 1 query is ran based on the filter.</P> Wed, 30 Oct 2024 17:11:08 GMT https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703151#M238361 taruntalreja 2024-10-30T17:11:08Z https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703187#M238362 <P>Why don't you try with macros and if, case statement?&nbsp;</P> Wed, 30 Oct 2024 18:03:16 GMT https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703187#M238362 alexandarmatev1 2024-10-30T18:03:16Z https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703259#M238370 <P>SPL does not support conditional execution of commands.&nbsp; It can be simulated in a dashboard by setting a token to the desired search string and referencing the token in the query.</P><LI-CODE lang="markup">&lt;fieldset&gt; &lt;input token="myInput"...&gt; &lt;change&gt; &lt;condition match="&lt;&lt;option 1&gt;&gt;"&gt; &lt;set token="query"&gt;SPL for option 1&lt;/set&gt; &lt;/condition&gt; &lt;condition match="&lt;&lt;option 2&gt;&gt;"&gt; &lt;set token="query"&gt;SPL for option 2&gt;&lt;/set&gt; &lt;/condition&gt; &lt;/change&gt; &lt;/input&gt; &lt;/fieldset&gt; ... &lt;row&gt; &lt;panel&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;$query$&lt;/query&gt; &lt;/search&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt;</LI-CODE> Thu, 31 Oct 2024 13:14:15 GMT https://community.splunk.com/t5/Splunk-Search/Executing-Conditional-Queries-in-Splunk-Based-on-Input-Value/m-p/703259#M238370 richgalloway 2024-10-31T13:14:15Z