My query looks like this
index=* sourcetype="MYSOURCE" | table company_id | dedup company_id | where company_id != "-"
| lookup companyid_companyname_usercount.csv CompanyId as company_id OUTPUT Name
| table company_id Name | sort Name
The first part of the query is
index=* sourcetype="MYSOURCE" | table company_id | dedup company_id | where company_id != "-"
second part
| lookup companyid_companyname.csv CompanyId as company_id OUTPUT Name
| table company_id Name | sort Name
Requirement: I want to perform the second part of my query only if 'companyid_companyname.csv' exists. other wise just return the list of company IDs.
I have tried using the IF in eval, but not sure how the else part of the query can workout.
Any thoughts and help is highly appreciated
The if function does not support conditional command execution.
The lookup file must exist for the lookup command to function.
@richgalloway thanks for the input!
How about using a 'WHERE' clause? is it still impossible to execute a command conditionally using the WHERE clause?