Splunk Search

Is it possible to call lookup within case statement?

RSS_STT
Explorer

I want to call lookup within case statement. if possible, please share sample query.

Labels (1)
Tags (1)
0 Karma

RSS_STT
Explorer

I have fields aa, bb, cc, dd, hostname and sometime few filed value may be null in payload.

What i want to do.

if (aa, bb is not null) than lookup abc.csv name output name hostname ip

if (cc, dd is not null)  than lookup abc.csv name output name hostname ip

if hostname=echo than lookup abc.csv name output name hostname ip

Here is the catch, if 1st if condition is executed it should ignore 2nd & 3rd.

if 2nd if statement executed than 3rd should ignored. Like wise i have to go upto 10 if condition.

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since all the lookups appear to be the same, why not do the lookup first, then evaluate (with your conditions) whether the results are worth keeping?

ITWhisperer
SplunkTrust
SplunkTrust

The simple answer is no - what is your usecase? what are you trying to achieve? There may be another way

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Yes you can using the lookup eval command

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/ConditionalFunctions#look...

It has to come from a CSV, you cannot use KV store lookups

 

ITWhisperer
SplunkTrust
SplunkTrust

Good point - not easy to use in a case statement though

0 Karma

bowesmana
SplunkTrust
SplunkTrust

True enough - it's fiddly and requires post processing of the JSON output, but it's one of the rare conditional if/execute pieces of powerful logic in SPL

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...