Splunk Search

How can we add token based condition to search query ?

AKG1_old1
Builder

below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.

Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")

   <search>
        <query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
        <finalized>
          <condition match="'job.resultCount'>0">
            <set token="vmstat_earliest_token">$result.earliest$</set>
            <set token="vmstat_latest_token">$result.latest$</set>
          </condition>
          <condition match="'job.resultCount'==0">
            <unset token="vmstat_earliest_token"></unset>
            <unset token="vmstat_latest_token"></unset>
          </condition>
        </finalized>
      </search>
Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>. You can use depends to hide/execute an entire panel (and the search inside it) based on whether a token is set.

0 Karma

niketn
Legend

@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AKG1_old1
Builder

Check_Status is set through drill down in a table content.

 <table id="table1">
        <search>
           <query> Query </query>
          <earliest>-150d@d</earliest>
          <latest>now</latest>`enter code here`
        </search>
        <drilldown>
           <set token="Check_Status">LOG_DROP</set>
       </drilldown>
        <option name="count">9</option>
        <option name="drilldown">cell</option>
      </table>
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...