topic Re: If/else conditional statements for search?? in Splunk Search

If/else conditional statements for search??

monicato — Fri, 20 Jul 2012 21:04:49 GMT

Is it possible to have an if else conditional statement in search? I'm creating a form with a drop-down list and depending on which option the user chooses, the results are calculated differently. I need something that will do

if $eventtype$="event1" then, calculate completion rate this way,

else, calculate completion rate another way

Can this be done? I have a form and this search will be in a

~Thanks!!

Re: If/else conditional statements for search??

Ayn — Fri, 20 Jul 2012 21:23:13 GMT

What does your whole search look like, and how are you calculating things? Splunk has the eval command which either can be used by itself (| eval foo=if(eventtype="event1",somecalculation,someothercalculation)) or as part of some kind of stats command (| stats count(eval(someevalcondition)) for instance, replace with whatever statistical function you want). There's also case which lets you specify an arbitrary number of options rather than just the if statements 2 (either eventtype is this, or it isn't).

Re: If/else conditional statements for search??

monicato — Fri, 20 Jul 2012 21:51:37 GMT

ah thanks! I was looking for the if statement format! Thank you!

Re: If/else conditional statements for search??

john — Tue, 09 Oct 2012 09:12:54 GMT

You can try conditionalswitcher modules to switch your modules or searches on basis of user input.

Re: If/else conditional statements for search??

Splunk_U — Wed, 09 Jan 2013 15:32:22 GMT

how to do that?