Help with filtering on base search with If query

Reporting

Hey,

I have a big base search and I want to add a condition in the search that would remove/ filter out Asset_State if either Development or "Pre-Production" ONLY IF Asset_Environment!="PKI Offline" Status="2.

At the moment, this is the line in the query I have for this:
.......| if(Asset_Environment!="PKI Offline" Status="2, search NOT (Asset_State!="Development" OR Asset_State!="Pre-Production") |....

Syntactically, I know this is incorrect .... can someone please help???

Many thanks as always!!!

Get Updates on the Splunk Community!

Help with filtering on base search with If query

data model

saved search

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you a member of the Splunk Community?

Help with filtering on base search with If query

data model

saved search

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...