Can I use a IF\ElSE in a props.conf?

[pfabrizi]

Can I use IF\ELSE in a PROPS.conf? What does the syntax look like.

basically we want to do a if this eventid then do this else do this.

can I nest them.

[mayurr98 · Accepted solution]

hey yes you can do!!

Calculated fields with props.conf example

This example examines earthquake data and classifies quakes by their depth by creating a Description field:

source=eqs7day-M1.csv | eval Description=case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep") | table Datetime, Region, Depth, Description

Steps
Using calculated fields, you could define the eval expression for the Description field in props.conf.

1. Create the following stanza in props.conf.

   <Stanza>
Eval-Description = case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep")

2 . Rewrite the search as:

source=eqs7day-M1.csv | table Datetime, Region, Depth, Description

You can now search on Description as if it is any other extracted field. Splunk software will find the calculated field key and evaluate it for every event that contains a Depth field. You can also run searches like this:

source=eqs7day-M1.csv Description=Deep

Refer this link for more it is the same
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurecalculatedfieldswithprops.con...

let me know if this helps!