Executing Conditional Queries in Splunk Based on Input Value

[taruntalreja]

I have two query in splunk query 1 and query 2 and an input. Based on the input, i need to execute either query 1 or query 2. I am trying something like below query but it is not working for me.

| makeresults
| eval myInput="*"

| append [
search "my search related to query 1"
| rex field=_raw "Job id : (?<job_id>[^,]+)"
| where myInput="*"
| eval query_type="query1"
| table job_id, query_type, myInput
]
| append [
search "my search related to query 2"
| rex field=_raw "Job id : (?<job_id>[^,]+)"
| where myInput!="*"
| eval query_type="query2"
| table job_id, query_type, myInput
]

[richgalloway]

SPL does not support conditional execution of commands.  It can be simulated in a dashboard by setting a token to the desired search string and referencing the token in the query.

<fieldset>
  <input token="myInput"...>
    <change>
      <condition match="<<option 1>>">
        <set token="query">SPL for option 1</set>
      </condition>
      <condition match="<<option 2>>">
        <set token="query">SPL for option 2></set>
      </condition>
    </change>
  </input>
</fieldset>
...
<row>
  <panel>
    <table>
      <search>
        <query>$query$</query>
      </search>
    </table>
  </panel>
</row>

[alexandarmatev1]

| makeresults
| eval myInput="*"

| append [
    | search "my search related to query 1"
    | rex field=_raw "Job id : (?<job_id>[^,]+)"
    | eval query_type=if(myInput="*", "query1", null())
    | where query_type="query1"
    | table job_id, query_type, myInput
]

| append [
    | search "my search related to query 2"
    | rex field=_raw "Job id : (?<job_id>[^,]+)"
    | eval query_type=if(myInput!="*", "query2", null())
    | where query_type="query2"
    | table job_id, query_type, myInput
]

[taruntalreja]

This solution does not work, I am getting empty result. I think there is an issue and myInput variable is not passed in append. One more issue with this solution is that both the queries will be running but we know beforehand which query to run, so I am looking for some optimized solution where only 1 query is ran based on the filter.

[alexandarmatev1]

Why don't you try with macros and if, case statement?