Splunk Search

How to conditionally add a search field?


I'd like to conditionally add a parameter to my Splunk query based on the version number of my application.

I have an "uploadType" input that I want to use, but only for events where the app version is over a certain number because the old versions do not contains this field.

Something like:

if appVersion >= 10.0
then include uploadType=$uploadType$,
otherwise don't filter this field.

Is this possible?

0 Karma