Splunk Search

Conditional search

Bulluk
Path Finder

I have 2 fields that I need to search on - Field1 and Field2. Most of the time I only want to search on Field1 but occasionally it contains a value which means I need to also search for Field2. I have a rex statement which populates a variable when Field1 contains the keyword so I need my search to look like this:

rex KeywordFound=(find the key word) |
if KeywordFound is null search for Field1
else search for Field1 and Field2 |

Can this kind of conditional search be done with Splunk?

Thanks

Tags (3)
0 Karma
1 Solution

Ayn
Legend

Do you need just to search for the general existence of Field1 and Field2?

I imagine you could use a subsearch to accomplish this. You start off the outer search with searching for Field1 and then use the subsearch for adding a search for Field2 if the subsearch finds the keyword. Something like this:

Field1=* [search * | rex (?<KeywordFound>blahblah) | search KeywordFound=* | head 1 | eval query="Field2=*" | fields query]

View solution in original post

Ayn
Legend

Do you need just to search for the general existence of Field1 and Field2?

I imagine you could use a subsearch to accomplish this. You start off the outer search with searching for Field1 and then use the subsearch for adding a search for Field2 if the subsearch finds the keyword. Something like this:

Field1=* [search * | rex (?<KeywordFound>blahblah) | search KeywordFound=* | head 1 | eval query="Field2=*" | fields query]

Bulluk
Path Finder

I'm not completely following your logic but you post has given me an idea that should work. When KeywordFound is null I'll evaluate Field2 to a wildcard so that all events match, meaning the only field actually being used in the search is Field1.

I'm off to try out the theory. If it works I shall award the points 🙂

Thanks

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...