Splunk Search

If else conditional search returning table

neerajs_81
Path Finder

Hello,  i need to configure a search using If else condition but the search outputs in a table format.  Can someone please assist ?

Original snippet of the search :

 

 

index=index1 sourcetype=index1:xyz eventName IN( GetAction, PutAction,ModifyAction) | [Search...]

 

 



Requirement :  Separate using IF-else as follows:

index=index1 sourcetype=xyz IF eventName in ( PutAction, GetAction) then [ run search 1 ] else if eventName in (ModifyAction ) then [run search 2]

Please note both search1 and 2  returns results in Table format.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search 1 | where eventName="GetAction" OR eventName="PutAction"
| append [search 2 | where eventName="ModifyAction"]

neerajs_81
Path Finder

Thank you for responding.  The search is taking forever to complete if i put where condition towards the end as you mentioned.
On the other hand, if  i  use eventName IN ( ) at the beginning, the search completes much faster.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The problem with your question is that there is not enough detail about how the different searches and events returned by those searches relate to each other. Without this sort of detail, it is difficult to suggest something which might help.

0 Karma

neerajs_81
Path Finder

I will DM you. Thanks

0 Karma