Splunk Search

Conditional search command

Simon
Contributor

Hi Splunkers,

I was wondering if it's possible to run a search command only under specific conditions?
E.g. when a field containts a specific value or when total number of results are at least X.

Example:
I'm running a search which populates a CSV with outputlookup, but I'd only wanted to write the CSV if there we're any search results.

Other example:
Run iplocation only if Country field is empty.

Thanks,
Simon

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try following

    |multisearch 
    [search <your base search> | where Country=null() | iplocation....] 
    [search <your base search> | where NOT Country=null() ] 
    | <your other search to get result for outputlookup>
    | append  [inputlookup <lookupfilename> | eventstats count as LU_Count] 
    | eventstats count as Total | eval LU_Count=coalesce(LU_Count,Total) | where LU_Count=Total 
    | fields <list of fields to be exported to lookup csv file> 
    | outputlookup <lookupfilename>

Two subsearches in "|multisearch" will split results from "" to two portion, one with Country=null() and one with Country!=null(). iplocation will be done only for records with Country=null().
Then you append existing data from lookup csv file and LU_Count and Total is calculated.
When your search produces result, LU_Count for results from existing lookup csv file will be less then total and hence will be filtered out (only your base search results are written). If you search produces no result, then result from existing lookup file will be rewritten, hence no data loss.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try following

    |multisearch 
    [search <your base search> | where Country=null() | iplocation....] 
    [search <your base search> | where NOT Country=null() ] 
    | <your other search to get result for outputlookup>
    | append  [inputlookup <lookupfilename> | eventstats count as LU_Count] 
    | eventstats count as Total | eval LU_Count=coalesce(LU_Count,Total) | where LU_Count=Total 
    | fields <list of fields to be exported to lookup csv file> 
    | outputlookup <lookupfilename>

Two subsearches in "|multisearch" will split results from "" to two portion, one with Country=null() and one with Country!=null(). iplocation will be done only for records with Country=null().
Then you append existing data from lookup csv file and LU_Count and Total is calculated.
When your search produces result, LU_Count for results from existing lookup csv file will be less then total and hence will be filtered out (only your base search results are written). If you search produces no result, then result from existing lookup file will be rewritten, hence no data loss.

Simon
Contributor

Exactly what I was searching for, perfect! Thank you

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Simon,

I would try something like this, for the outputlookup example:

YourMagicSearchFoo | stats count | where count>0 | YourOtherMagicSearchFoo

or for the iplocation example:

YourMagicSearchFoo | where Country=null() | YourOtherMagicSearchFoo

hope this helps to get you started ...

cheers, MuS

0 Karma

Simon
Contributor

Nice suggestion, but in your case, I'll always loose events, which is not exactly what I want.
To be more precise:

Example 1:
I wanted to populate the CSV only, if there were any results, but then, I want to write all of them. If there are no results, I want to keep the old CSV.

Example 2:
Maybe the result already contains a Country field. If no, and only in this case, I wanted to run iplocation.
The idea is to reduce the amount of iplocation calls.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...