Splunk Search
Highlighted

How can I use an if or eval statement to run a custom search command

Path Finder

Hello Splunkers -

Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts?

| eval valueToTest=if(isnotnull(statementHere),0,1)
| if (1 do customCommand1)
| if (0 do customCommand2)
Tags (4)
0 Karma
Highlighted

Re: How can I use an if or eval statement to run a custom search command

SplunkTrust
SplunkTrust

As far as I know this is still not possible out of the box, but you could put the logic into your custom command instead.

cheers, MuS

Highlighted

Re: How can I use an if or eval statement to run a custom search command

SplunkTrust
SplunkTrust

Try something like this...

  | eval valueToTest=if( your test here ,1,2)
  | appendpipe [ | where valueToTest==1 | do customCommand1 | eval rectype="1"]
  | appendpipe [ | where valueToTest==2 | do customCommand2 | eval rectype="2"]
  | where isnotnull(rectype)
Highlighted

Re: How can I use an if or eval statement to run a custom search command

Path Finder

This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?

0 Karma