Can I use a search again in an eval if condition?

[kranthi851]

Hi,

From a search, I will get two fields HOST and SRC. I have to join this with other two searches (query-1, query-2) to get the USER field. I have to join query-1 with HOST as a common field, but if I don't have user details in there, then I have to use SRC as common field in query-2 to get the USER.

Search I'm using:

index=abc| join type=left HOST [search index=XYZ earliest=-30d latest=now] | rename Login as user|eval user=if(isnull(user) OR user="","unknown",user)|eval user=if(user=unknown,(search index=abc|join SRC[index=123], USER)|tableHOST SRC USER

If user is not available in query-1, how to search in query-2?

[somesoni2 · Accepted solution]

Try like this

index=abc| join type=left HOST [search index=XYZ earliest=-30d latest=now] |join type=left SRC [search index=123 ] | eval USER=coalesce(Login,USER) |tableHOST SRC USER

The join 1 gives you field Login and join2 will give you field USER. In the end, the coalesce function will take the first not null values from both the column and assign to USER field.

[kranthi851]

Thanks for the reply! suppose for a same event if i got Login=uname and USER=lname, In the final result of USER will it show both or Just the Login result.?

[somesoni2]

Just Login (first non-null value). You can replace that coalesce command with a case statement to handle mulitple scenarios as per your requirement.