Is it possible to call lookup within case statement?

[RSS_STT]

I want to call lookup within case statement. if possible, please share sample query.

[RSS_STT]

I have fields aa, bb, cc, dd, hostname and sometime few filed value may be null in payload.

What i want to do.

if (aa, bb is not null) than lookup abc.csv name output name hostname ip

if (cc, dd is not null)  than lookup abc.csv name output name hostname ip

if hostname=echo than lookup abc.csv name output name hostname ip

Here is the catch, if 1st if condition is executed it should ignore 2nd & 3rd.

if 2nd if statement executed than 3rd should ignored. Like wise i have to go upto 10 if condition.

[ITWhisperer]

Since all the lookups appear to be the same, why not do the lookup first, then evaluate (with your conditions) whether the results are worth keeping?

[ITWhisperer]

The simple answer is no - what is your usecase? what are you trying to achieve? There may be another way

[bowesmana]

Yes you can using the lookup eval command

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/ConditionalFunctions#look...

It has to come from a CSV, you cannot use KV store lookups

[ITWhisperer]

Good point - not easy to use in a case statement though

[bowesmana]

True enough - it's fiddly and requires post processing of the JSON output, but it's one of the rare conditional if/execute pieces of powerful logic in SPL