Splunk Search

Functions in splunk query language


Is it possible to create functions in the splunk query language? Right now I am working to try and correlate call detail records for a telephony platform. Essentially every call can generate N records, where N is determined by the type of call, features invoked, etc. To correlate the records correctly, it would be awesome if I could have some sort of branching ability based on the values of fields. Something along these lines:

if(service_provider==wdv_trunking,(true search query),(false search query))?
Tags (1)


Splunk's search language is extremely flexible. There are a number of commands out-of-the-box such as "| eval" and "| transaction". If you find something that can't be done using a shipped command, Splunk gives the ability to create your own search command using python.

See: Search Reference

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!