If else conditional search returning table

[neerajs_81]

Hello,  i need to configure a search using If else condition but the search outputs in a table format.  Can someone please assist ?

Original snippet of the search :

index=index1 sourcetype=index1:xyz eventName IN( GetAction, PutAction,ModifyAction) | [Search...]

Requirement :  Separate using IF-else as follows:

index=index1 sourcetype=xyz IF eventName in ( PutAction, GetAction) then [ run search 1 ] else if eventName in (ModifyAction ) then [run search 2]

Please note both search1 and 2  returns results in Table format.

[ITWhisperer]

search 1 | where eventName="GetAction" OR eventName="PutAction"
| append [search 2 | where eventName="ModifyAction"]

[neerajs_81]

Thank you for responding.  The search is taking forever to complete if i put where condition towards the end as you mentioned.
On the other hand, if  i  use eventName IN ( ) at the beginning, the search completes much faster.

[ITWhisperer]

The problem with your question is that there is not enough detail about how the different searches and events returned by those searches relate to each other. Without this sort of detail, it is difficult to suggest something which might help.

[neerajs_81]

I will DM you. Thanks