Splunk Search

How can I use an if or eval statement to run a custom search command

splunker1981
Path Finder

Hello Splunkers -

Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts?

| eval valueToTest=if(isnotnull(statementHere),0,1)
| if (1 do customCommand1)
| if (0 do customCommand2)
Tags (4)
0 Karma

DalJeanis
Legend

Try something like this...

  | eval valueToTest=if( your test here ,1,2)
  | appendpipe [ | where valueToTest==1 | do customCommand1 | eval rectype="1"]
  | appendpipe [ | where valueToTest==2 | do customCommand2 | eval rectype="2"]
  | where isnotnull(rectype)

splunker1981
Path Finder

This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?

0 Karma

MuS
Legend

As far as I know this is still not possible out of the box, but you could put the logic into your custom command instead.

cheers, MuS

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...