If/else conditional statements for search??

[monicato]

Is it possible to have an if else conditional statement in search? I'm creating a form with a drop-down list and depending on which option the user chooses, the results are calculated differently. I need something that will do

if $eventtype$="event1" then, calculate completion rate this way,

else, calculate completion rate another way

Can this be done? I have a form and this search will be in a

~Thanks!!

[Ayn · Accepted solution]

What does your whole search look like, and how are you calculating things? Splunk has the eval command which either can be used by itself (| eval foo=if(eventtype="event1",somecalculation,someothercalculation)) or as part of some kind of stats command (| stats count(eval(someevalcondition)) for instance, replace with whatever statistical function you want). There's also case which lets you specify an arbitrary number of options rather than just the if statements 2 (either eventtype is this, or it isn't).

[Splunk_U]

how to do that?

[john]

You can try conditionalswitcher modules to switch your modules or searches on basis of user input.

[monicato]

ah thanks! I was looking for the if statement format! Thank you!