Splunk Search

How to do Conditional Searches?

secphilomath
New Member

Is there a way to do a search like this;

If Eventid=1111

    only do these  statements

elseif Eventid=2222

    only do these statements

elseif eventid=3333

   only do these statements

Do these extra statements ...

Labels (1)
Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@secphilomath - Not sure what is your goal exactly but based on what you have described, you can try appendpipe command.

<your-search>
| appendpipe [| search event_id=1 | mycommand1 ]
| appendpipe [| search event_id=2 | mycommand2 ]
<anything else>

 

I hope this helps!!!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do if logic in eval statements, but there is no "if" block. It will depend on what you want to do in those conditions.

You can often achieve if type logic, can you give an example of the sort of actions you want to take.

 

0 Karma

secphilomath
New Member

Essentially I want to run 3 different search commands depending on the value of the eventid.  

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...