topic How to create a table based if condition result? in Splunk Search

How to create a table based if condition result?

Premkumarpalani — Thu, 05 Mar 2015 06:29:26 GMT

i wanna know how to display the result after specifying an if condition.
the sample search is like :

index=xyz | order="0000" | eval Order_status=if(order!=0,"found","not found") | .....

after this condition, if order=found, I need to display a table with few fields....please help me to solve this.

Re: How to create a table based if condition result?

MuS — Thu, 05 Mar 2015 06:50:42 GMT

Hi Premkumarpalanichamy,

something like this works perfect for me:

index=_internal  | head 1 | eval order="0000" | eval Order_status=if(order!="0","found","not found") | table Order_status order | where Order_status="found"

adapt it to your needs.

cheers, MuS