Search help -- Display count if field is present in the output

[renjujacob88]

Hi Splunkers ,

Need help in creating the case statement.

We are feeding the palo alto logs to the threat intelligence of splunk( ip_intel) to see if any blacklisted ip is hitting the perimeters.
The query which I wrote is given below with the snapshot of the output

index=palo src_ip!=10.* | rename src_ip as ip | stats values(action) as action max(_time) as LastSeen min(_time) as FirstSeen dc(dest_ip) as dest_count values(threat_name) as threat_name values(severity) as severity count by ip|lookup ip_intel ip as ip OUTPUT description threat_key | table ip description threat_key action LastSeen FirstSeen threat_name severity dest_count count | eval description = if(isnull(description),"YES",description) | eval threat_key = if(isnull(threat_key),"YES",threat_key) | where threat_key!="YES" | convert ctime(LastSeen) ctime(FirstSeen)|
Blockquote

Now we need to modify the query in such a way that if the threat_name is present in the output(field of palo alto) display the result(whatever the count may be).
If the threat_name fields are empty then search for the count and display the count which is above 100.

Appreciate the help

[niketn · Accepted solution]

@renjujacob88, following is based on sample data provided. Pipe the following to your existing results:

| eval attentionFlag=case(isnotnull(threat_name),"Investigate",isnull(threat_name) AND count>100,"Investigate",true(),"Ignore")
| search attentionFlag="Investigate"
| fields - attentionFlag