Splunk Search

How can we add token based condition to search query ?

AKG1_old1
Builder

below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.

Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")

   <search>
        <query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
        <finalized>
          <condition match="'job.resultCount'>0">
            <set token="vmstat_earliest_token">$result.earliest$</set>
            <set token="vmstat_latest_token">$result.latest$</set>
          </condition>
          <condition match="'job.resultCount'==0">
            <unset token="vmstat_earliest_token"></unset>
            <unset token="vmstat_latest_token"></unset>
          </condition>
        </finalized>
      </search>
Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>. You can use depends to hide/execute an entire panel (and the search inside it) based on whether a token is set.

0 Karma

niketn
Legend

@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AKG1_old1
Builder

Check_Status is set through drill down in a table content.

 <table id="table1">
        <search>
           <query> Query </query>
          <earliest>-150d@d</earliest>
          <latest>now</latest>`enter code here`
        </search>
        <drilldown>
           <set token="Check_Status">LOG_DROP</set>
       </drilldown>
        <option name="count">9</option>
        <option name="drilldown">cell</option>
      </table>
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...