https://community.splunk.com/t5/Splunk-Search/Append-search-term-based-on-condition/m-p/155600#M43786 <P>How can I append a search term based on a condition?</P> <P>For example - </P> <PRE>if fieldA &gt; 1 </PRE>I want to append <PRE>| search someCriteriaA</PRE> else I want to append <PRE>| search someOtherCriteriaB</PRE> <P>Here fieldA is output of eventstats.. hence the value of the fieldA would be same across the events</P> Thu, 24 Jul 2014 02:33:02 GMT pradeepkumarg 2014-07-24T02:33:02Z https://community.splunk.com/t5/Splunk-Search/Append-search-term-based-on-condition/m-p/155600#M43786 <P>How can I append a search term based on a condition?</P> <P>For example - </P> <PRE>if fieldA &gt; 1 </PRE>I want to append <PRE>| search someCriteriaA</PRE> else I want to append <PRE>| search someOtherCriteriaB</PRE> <P>Here fieldA is output of eventstats.. hence the value of the fieldA would be same across the events</P> Thu, 24 Jul 2014 02:33:02 GMT https://community.splunk.com/t5/Splunk-Search/Append-search-term-based-on-condition/m-p/155600#M43786 pradeepkumarg 2014-07-24T02:33:02Z https://community.splunk.com/t5/Splunk-Search/Append-search-term-based-on-condition/m-p/155601#M43787 <P>Why not this</P> <PRE><CODE>yourbasesearch (fieldA &gt; 1 AND someCriteriaA) OR (fieldA &lt;= 1 AND someOtherCriteriaB) </CODE></PRE> <P>Oops - just saw the <CODE>eventstats</CODE> comment. Then do this</P> <PRE><CODE>yourbasesearch | eventstats something to get fieldA | search (fieldA &gt; 1 AND someCriteriaA) OR (fieldA &lt;= 1 AND someOtherCriteriaB) </CODE></PRE> Thu, 24 Jul 2014 06:02:57 GMT https://community.splunk.com/t5/Splunk-Search/Append-search-term-based-on-condition/m-p/155601#M43787 lguinn2 2014-07-24T06:02:57Z