Append search term based on condition

[pradeepkumarg]

How can I append a search term based on a condition?

For example -

if fieldA > 1 

I want to append

| search someCriteriaA

else I want to append

| search someOtherCriteriaB

Here fieldA is output of eventstats.. hence the value of the fieldA would be same across the events

[lguinn2 · Accepted solution]

Why not this

yourbasesearch (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)

Oops - just saw the eventstats comment. Then do this

yourbasesearch
| eventstats something to get fieldA
| search (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)