topic Re: help me with search command in Splunk Search

help me with search command

sravankaripe — Fri, 24 Mar 2017 20:39:13 GMT

-------| eval test=if(condition,"INFO","Error") | search test

if condition is true the search must be behave as
--------| search "INFO"

else
--------| search "Error"

please help me with this

Re: help me with search command

kiran331 — Fri, 24 Mar 2017 20:42:05 GMT

use tokens

-------| eval test=if(condition,"INFO","Error") | search $test$

Re: help me with search command

niketn — Fri, 24 Mar 2017 20:52:13 GMT

@sravankaripe... You would actually need to provide details around what is your conditions and what is the event when the condition will be triggered.

Please see a example below where I am running a dummy search to set my token. Then I am using the token in the actual search as search query filter. There are multiple possibilities and solutions.

  <search>
    <query>| makeresults
| eval log_level="INFO"
| table testData</query>
  <preview>
    <eval token="queryString">if(log_level=="INFO","INFO","ERROR")</eval>
  </preview>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype="splunkd" log_level="$queryString$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>          
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>

Re: help me with search command

woodcock — Fri, 24 Mar 2017 20:54:25 GMT

Like this (with a subsearch):

... | search [|noop | stats count AS search | eval search=if(condition, "INFO, "Error") | return $search]