Is there a way to do a search like this;
If Eventid=1111
only do these statements
elseif Eventid=2222
only do these statements
elseif eventid=3333
only do these statements
Do these extra statements ...
@secphilomath - Not sure what is your goal exactly but based on what you have described, you can try appendpipe command.
<your-search>
| appendpipe [| search event_id=1 | mycommand1 ]
| appendpipe [| search event_id=2 | mycommand2 ]
<anything else>
I hope this helps!!!
You can do if logic in eval statements, but there is no "if" block. It will depend on what you want to do in those conditions.
You can often achieve if type logic, can you give an example of the sort of actions you want to take.
Essentially I want to run 3 different search commands depending on the value of the eventid.