topic Re: How to return events based on if else rules in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174061#M49930 <P>Maybe a transaction will help.</P> <PRE><CODE>sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ... </CODE></PRE> Wed, 21 May 2014 15:25:40 GMT richgalloway 2014-05-21T15:25:40Z How to return events based on if else rules https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174060#M49929 <P>I have events like these:</P> <P>20131212 17:59:07@VE@SANL31 EHDB 121755 CCA@06240@EHAM@ @E 4.47N52.18@Successfully completed<BR /> 20131212 17:57:17@VE@SANL31 EHDB 121755 @06240@EHAM@ @E 4.47N52.18@Successfully completed</P> <P>These events belong together because they have the same MessageTime (121755). Using the following subsearch I can return them in pairs:</P> <P>[search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed</P> <P>How can I refine this search in order to only return the one containing CCA when there is no message not containing the CCA? In this example no event should be returned because both appear. If however the second event was not there I want to keep the first one.</P> Wed, 21 May 2014 14:57:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174060#M49929 rijk 2014-05-21T14:57:00Z Re: How to return events based on if else rules https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174061#M49930 <P>Maybe a transaction will help.</P> <PRE><CODE>sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ... </CODE></PRE> Wed, 21 May 2014 15:25:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174061#M49930 richgalloway 2014-05-21T15:25:40Z Re: How to return events based on if else rules https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174062#M49931 <P>Thanks, indeed no subsearches but transactions.</P> Thu, 22 May 2014 09:37:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-events-based-on-if-else-rules/m-p/174062#M49931 rijk 2014-05-22T09:37:33Z