if Condition then print table A, ELSE table B

[dbattaglia]

hello experts,

I'm trying to do a simple thing but I'm not able to figure it out.

so, my problem is that I want to produce a table based on a condition, like below:

if condition=TRUE, stats values(A) as A, values(B) as B by C, ("ELSE") stats values(Z) as Z, values(X) as X by Y

SO, if the condition is true I want to built a table with certain variables, otherwise with some others.

Thanks much.

[woodcock · Accepted solution]

You could do something like this:

index="_*"
| eval foo="bar"
| multireport
[stats count first(foo) AS foo BY index | where foo="bar" ]
[stats count first(foo) AS foo BY sourcetype | where foo="bat" ]

vs. this:

index="_*"
| eval foo="bat"
| multireport
[stats count first(foo) AS foo BY index | where foo="bar" ]
[stats count first(foo) AS foo BY sourcetype | where foo="bat" ]

[dbattaglia]

Great, this is working! Thanks Much!
Not sure why is messing the order of the fields in the stats... but is working.

Again, thanks much.

[MuS]

Hi dbattaglia,

you need to move the logic outside of the stats command in this case, try something like this:

 base SPL here
 | eval A=if(condition=TRUE, A, Z), B=if(condition=TRUE, B, X), C=if(condition=TRUE, C, Y)
 | stats values(A) AS A, values(B) AS B by C

Hope this helps ...

cheers, MuS

[dbattaglia]

Thanks MuS, this is almost perfect, only issue is that as results of the stats I get always A, B, C as field names, other than that everything else is good.

would you know how to change dynamically the field names as result of the eval if?

Thanks very much, appreciated.

[MuS]

Hi dbattaglia,

I reckon the only way to get this working like this would be in a dashboard and use token to replace the values. I don't think this is possible in ad-hoc search.

cheers, MuS