How to do Conditional Searches?

[secphilomath]

Is there a way to do a search like this;

If Eventid=1111

    only do these  statements

elseif Eventid=2222

    only do these statements

elseif eventid=3333

   only do these statements

Do these extra statements ...

[VatsalJagani]

@secphilomath - Not sure what is your goal exactly but based on what you have described, you can try appendpipe command.

<your-search>
| appendpipe [| search event_id=1 | mycommand1 ]
| appendpipe [| search event_id=2 | mycommand2 ]
<anything else>

I hope this helps!!!

[bowesmana]

You can do if logic in eval statements, but there is no "if" block. It will depend on what you want to do in those conditions.

You can often achieve if type logic, can you give an example of the sort of actions you want to take.

[secphilomath]

Essentially I want to run 3 different search commands depending on the value of the eventid.