Splunk Search

How can I use an if or eval statement to run a custom search command

splunker1981
Path Finder

Hello Splunkers -

Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts?

| eval valueToTest=if(isnotnull(statementHere),0,1)
| if (1 do customCommand1)
| if (0 do customCommand2)
Tags (4)
0 Karma

DalJeanis
Legend

Try something like this...

  | eval valueToTest=if( your test here ,1,2)
  | appendpipe [ | where valueToTest==1 | do customCommand1 | eval rectype="1"]
  | appendpipe [ | where valueToTest==2 | do customCommand2 | eval rectype="2"]
  | where isnotnull(rectype)

splunker1981
Path Finder

This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?

0 Karma

MuS
Legend

As far as I know this is still not possible out of the box, but you could put the logic into your custom command instead.

cheers, MuS

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...