Splunk Search
Highlighted

How to incorporate tag in the if-then-else Splunk construct

New Member

Hello,
I created SPL search, that should pull out the log entries, based on the if-then-else condition, but it does not work correctly.
Please, find this search below:

index=cdc_apache OR index=datapower
| eval tag_name=if(index=="cdc_apache", "ED_ENDI_Digital_Retail_WebS_Test", 'NULL') 
| where (tag=tag_name) 
| where isnum(status)

I need to find the log entries from both indexes: index=cdcapache and index=datapower. But I'm getting log entries ONLY from index=cdcapache. I realize that my SPL query is wrong, but I don't know how to fix it.
Please, help.
Thanks,
Sergei Cher

0 Karma
Highlighted

Re: How to incorporate tag in the if-then-else Splunk construct

Path Finder

Look at using the case statement within an eval, it will provide the if then else statements. https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions

index IN (cdc_datapower, datapower)
|eval tag_name= case(index=="cdc_apache", "ED_ENDI_Digital_Retail_WebS_Test", index=="datapower", "Another_Tag_Name")
| where isnotnull(tag_name)
| stats values(tag_name) as tag_name by index
0 Karma
Highlighted

Re: How to incorporate tag in the if-then-else Splunk construct

New Member

I did not provide all the details (earlier I simplified my search), therefore, unfortunately, your SPL query will not work for me.
1) I'm using more complicated SPL query, and my goal is to use one tag for ALL the indexes, excluding index=cdcapache, and use another tag for ONLY one index=cdcapache.
Why do I want to do it:
I cannot combine hosts AND index in ONE tag, because they are combined by OR statement by default;
I need to combine them the following way in a tag:
index=datapower OR index=aaa OR index=bbb OR (index=cdc_apache AND (host=xxx, host=yyy, etc.)), but Splunk does not allow to do it.

Therefore, my SPL query really looks like this (I NEED TO USE DIFFERENT HOSTS WITH DIFFERENT INDEXES):

tag::index="ED_ENDI_ProdIndexED” 
| eval tag_name=case (index=="cdc_apache","ED_ENDI_Digital_Retail_WebS_Test", index !="cdc_apache", "ED_ENDI_ProdIndex_Test_1") 
| where isnotnull(tag_name) 
| eval tag=tag_name 
| where isnum(status)

In the above query:
tag “EDENDIProdIndexED” consists of the following field-value pairs:
index=cdcapache, index=cdcjboss, index=xxx, …, index=yyy

tag “EDENDIDigitalRetailWebS_Test” consists of the following field-value pairs:
host=aaa, host=bbb

tag "EDENDIProdIndexTest1" consist of the following field-value pairs:
host!=aaa host!=bbb

What I need as an output of my SPL query:
I need to show the log entries, where there is a numeric “status” field, for all the indexes. BUT for index=cdcapache I have to use ONLY two hosts OUT of five, for index!= cdcapache I have to use a different set of hosts (there are VERY MANY of them), except for the host=aaa AND host=bbb.
I realize that the above query does not work (it shows ALL five HOSTS for the index=cdc_apache – I tested it), but I don’t know how to change it in order to make it work.

I also think, that it is NOT valid to put host!=aaa host!=bbb in the tag (even if it is a correct way to do it – doubt it though - it combines these two hosts with OR and I need AND). But I cannot list all the hosts in the “EDENDIProdIndexTest1” tag, because, a) they should be discovered automatically and b) there are too many of them.

Please, advice.

0 Karma
Highlighted

Re: How to incorporate tag in the if-then-else Splunk construct

Ultra Champion

Have you considered using Splunk tags with event types?

For your three scenarios:
"EDENDIProdIndexED” consists of the following field-value pairs:
index=cdcapache, index=cdcjboss, index=xxx, …, index=yyy

“EDENDIDigitalRetailWebS_Test” consists of the following field-value pairs:
host=aaa, host=bbb

"EDENDIProdIndexTest1" consist of the following field-value pairs:
host!=aaa host!=bbb

Create an event type for each of the above and assosciate a tag with each one.
Then your search becomes

tag::ED_ENDI_ProdIndexED OR tag::ED_ENDI_Digital_Retail_WebS_Test OR tag::ED_ENDI_ProdIndex_Test_1
| stats values(tag) as tag by index
0 Karma