Hello Splunkers -
Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts?
| eval valueToTest=if(isnotnull(statementHere),0,1) | if (1 do customCommand1) | if (0 do customCommand2)
As far as I know this is still not possible out of the box, but you could put the logic into your custom command instead.
Try something like this...
| eval valueToTest=if( your test here ,1,2) | appendpipe [ | where valueToTest==1 | do customCommand1 | eval rectype="1"] | appendpipe [ | where valueToTest==2 | do customCommand2 | eval rectype="2"] | where isnotnull(rectype)
This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?