Splunk Search

Query partially if csv doesn't exist. -- Looking for IF-ELSE scenario with eval

aravindsurya77
Observer

My query looks like this

index=* sourcetype="MYSOURCE"  | table company_id | dedup company_id | where company_id != "-"
| lookup companyid_companyname_usercount.csv CompanyId as company_id OUTPUT Name
| table company_id Name | sort Name

 

The first part of the query is 

index=* sourcetype="MYSOURCE"  | table company_id | dedup company_id | where company_id != "-"

 

second part

| lookup companyid_companyname.csv CompanyId as company_id OUTPUT Name
| table company_id Name | sort Name

 

Requirement: I want to perform the second part of my query only if 'companyid_companyname.csv' exists. other wise just return the list of company IDs. 

 

I have tried using the IF in eval, but not sure how the else part of the query can workout. 

Any thoughts and help is highly appreciated

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The if function does not support conditional command execution.
The lookup file must exist for the lookup command to function.

---
If this reply helps you, Karma would be appreciated.
0 Karma

aravindsurya77
Observer

@richgalloway  thanks for the input!

How about using a 'WHERE' clause? is it still impossible to execute a command conditionally using the WHERE clause?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
SPL does not support conditional command execution. It is not a programming language.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...