Splunk Search

If else conditional search returning table

neerajs_81
Builder

Hello,  i need to configure a search using If else condition but the search outputs in a table format.  Can someone please assist ?

Original snippet of the search :

 

 

index=index1 sourcetype=index1:xyz eventName IN( GetAction, PutAction,ModifyAction) | [Search...]

 

 



Requirement :  Separate using IF-else as follows:

index=index1 sourcetype=xyz IF eventName in ( PutAction, GetAction) then [ run search 1 ] else if eventName in (ModifyAction ) then [run search 2]

Please note both search1 and 2  returns results in Table format.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search 1 | where eventName="GetAction" OR eventName="PutAction"
| append [search 2 | where eventName="ModifyAction"]

neerajs_81
Builder

Thank you for responding.  The search is taking forever to complete if i put where condition towards the end as you mentioned.
On the other hand, if  i  use eventName IN ( ) at the beginning, the search completes much faster.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The problem with your question is that there is not enough detail about how the different searches and events returned by those searches relate to each other. Without this sort of detail, it is difficult to suggest something which might help.

0 Karma

neerajs_81
Builder

I will DM you. Thanks

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...