Splunk Search

How to do Conditional Searches?

New Member

Is there a way to do a search like this;

If Eventid=1111

    only do these  statements

elseif Eventid=2222

    only do these statements

elseif eventid=3333

   only do these statements

Do these extra statements ...

Labels (1)
Tags (1)
0 Karma

Super Champion

@secphilomath - Not sure what is your goal exactly but based on what you have described, you can try appendpipe command.

| appendpipe [| search event_id=1 | mycommand1 ]
| appendpipe [| search event_id=2 | mycommand2 ]
<anything else>


I hope this helps!!!

0 Karma


You can do if logic in eval statements, but there is no "if" block. It will depend on what you want to do in those conditions.

You can often achieve if type logic, can you give an example of the sort of actions you want to take.


0 Karma

New Member

Essentially I want to run 3 different search commands depending on the value of the eventid.  

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...