Conditional searches in the same search

[julienlance]

Hello !

Is there a way to do conditonal searches depending of the result of a first search ?
I mean, here is an exemple :
- A search command returns a table with a field containing an interesting value, for instance "reachable" or "not-reachable"
- a second search command is executed only if the value is "reachable" is set in the first command
- This second search should be run for each row of the table of the first command.

In both commands, there are "eval" commands which are used for timestamp evaluations.
Here is a simplified version of my query :

index=* sourcetype=routes_devices 
| table _time,host-name, reachability 
| eval result=if(reachability=="reachable",
[search index=* sourcetype=router fields name], "NOK")

Is it possible to that kind of searches ? with the best performance possible.
Thanks for your help !

[adonio · Accepted solution]

not sure why not search for all and then eliminate ....
something like this:

index=* sourcetype=routes_devices OR sourcetype=router
 | table _time,host-name, reachability, name, sourcetype
 | eval result=if(reachability=="reachable",name,null())
 | search result=*

but maybe i am missing something

[renjith_nair]

@julienlance ,

Looking at your requirement, most probably map command should work for you.
Apart from running the second search for each row, you can set a token in the first search for the desired search and use that token in the second search in map. So if the token is not set , then the second search will not run.

e.g. eval searchToken=case (reachability=="reachable",true())

[julienlance]

Thanks you @renjith.nair, this is a great clue, I will try to use it !
Many thanks

[julienlance]

The eval command you specified doesn't work, as the token can't be a boolean (splunk said). 😞