Splunk Search

Can I use a search again in an eval if condition?

kranthi851
New Member

Hi,

From a search, I will get two fields HOST and SRC. I have to join this with other two searches (query-1, query-2) to get the USER field. I have to join query-1 with HOST as a common field, but if I don't have user details in there, then I have to use SRC as common field in query-2 to get the USER.

Search I'm using:

index=abc| join type=left HOST [search index=XYZ earliest=-30d latest=now] | rename Login as user|eval user=if(isnull(user) OR user="","unknown",user)|eval user=if(user=unknown,(search index=abc|join SRC[index=123], USER)|tableHOST SRC USER

If user is not available in query-1, how to search in query-2?

Tags (4)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=abc| join type=left HOST [search index=XYZ earliest=-30d latest=now] |join type=left SRC [search index=123 ] | eval USER=coalesce(Login,USER) |tableHOST SRC USER

The join 1 gives you field Login and join2 will give you field USER. In the end, the coalesce function will take the first not null values from both the column and assign to USER field.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=abc| join type=left HOST [search index=XYZ earliest=-30d latest=now] |join type=left SRC [search index=123 ] | eval USER=coalesce(Login,USER) |tableHOST SRC USER

The join 1 gives you field Login and join2 will give you field USER. In the end, the coalesce function will take the first not null values from both the column and assign to USER field.

0 Karma

kranthi851
New Member

Thanks for the reply! suppose for a same event if i got Login=uname and USER=lname, In the final result of USER will it show both or Just the Login result.?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Just Login (first non-null value). You can replace that coalesce command with a case statement to handle mulitple scenarios as per your requirement.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...