Splunk Search

If else conditional search returning table

neerajs_81
Builder

Hello,  i need to configure a search using If else condition but the search outputs in a table format.  Can someone please assist ?

Original snippet of the search :

 

 

index=index1 sourcetype=index1:xyz eventName IN( GetAction, PutAction,ModifyAction) | [Search...]

 

 



Requirement :  Separate using IF-else as follows:

index=index1 sourcetype=xyz IF eventName in ( PutAction, GetAction) then [ run search 1 ] else if eventName in (ModifyAction ) then [run search 2]

Please note both search1 and 2  returns results in Table format.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search 1 | where eventName="GetAction" OR eventName="PutAction"
| append [search 2 | where eventName="ModifyAction"]

neerajs_81
Builder

Thank you for responding.  The search is taking forever to complete if i put where condition towards the end as you mentioned.
On the other hand, if  i  use eventName IN ( ) at the beginning, the search completes much faster.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The problem with your question is that there is not enough detail about how the different searches and events returned by those searches relate to each other. Without this sort of detail, it is difficult to suggest something which might help.

0 Karma

neerajs_81
Builder

I will DM you. Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...