Splunk Search

Search inside Eval if statement possible ?

crt89
Communicator

Is it possible to put search inside an eval if statement ? I am making a search that if the count of the field is greater than 1 it would display "Please check your query" then if its equal to 1 it will proceed to my search..

 eval test=if(count>1,"Please check query",count==1,*search command goes here*

Is the eval if statement the thing to use ?

0 Karma

vganjare
Builder

Hi,

You can try using join.

The query can have following logic:

eval test=if(count>1,"Please check query","JOIN_SEARCH") | join test [your custom search | eval test="JOIN_SEARCH"]

Please note, the additional variable "test" in subsearch is required to join the record with first search. So, for all the events where the condition ( count > 1 ) fails, test variable in first search will get value of "JOIN_SEARCH".

Thanks!!

0 Karma

markthompson
Builder

The first point, is that the if statement only takes 3 arguments, if(condition, iftrue, iffalse).

0 Karma

jkat54
SplunkTrust
SplunkTrust

Can you please give more details? It would help to know the rest of your search string and what search command you want to append to it, etc.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...