Splunk Search

2 different lookups in if statement.

sumarri
Path Finder

When I search I want something like this:

if(ID =99): then lookup 1,

else: lookup 2.

What I have right now is something like this, but I done know how to put it in the correct syntax: 

| eval To_AccountID= if(ID="99",
[search | lookup Payroll1.csv PARENTACCOUNT OUTPUT Product_Type as To_AccountID, AccountType as To_Account],
[search | lookup Payroll2.csv PARENTACCOUNT, ID as PARENTID OUTPUT TYPE as To_AccountID, AccountType as To_Account])

What is the best way to code something like this??? 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

SPL is not a procedural language and does not have if...then...else... constructs

Try something like this

| lookup Payroll1.csv PARENTACCOUNT OUTPUT Product_Type as To_AccountID_99, AccountType as To_Account_99
| lookup Payroll2.csv PARENTACCOUNT, ID as PARENTID OUTPUT TYPE as To_AccountID_NOT_99, AccountType as To_Account_NOT_99
| eval To_AccountID= if(ID="99",To_AccountID_99,To_AccountID_NOT_99)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

SPL is not a procedural language and does not have if...then...else... constructs

Try something like this

| lookup Payroll1.csv PARENTACCOUNT OUTPUT Product_Type as To_AccountID_99, AccountType as To_Account_99
| lookup Payroll2.csv PARENTACCOUNT, ID as PARENTID OUTPUT TYPE as To_AccountID_NOT_99, AccountType as To_Account_NOT_99
| eval To_AccountID= if(ID="99",To_AccountID_99,To_AccountID_NOT_99)

sumarri
Path Finder

That is what I ended up doing, but I want to know if there was another way like that! Looks like it is the only way...

 

Thank you! 

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...