Splunk Search

Search inside Eval if statement possible ?

crt89
Communicator

Is it possible to put search inside an eval if statement ? I am making a search that if the count of the field is greater than 1 it would display "Please check your query" then if its equal to 1 it will proceed to my search..

 eval test=if(count>1,"Please check query",count==1,*search command goes here*

Is the eval if statement the thing to use ?

0 Karma

vganjare
Builder

Hi,

You can try using join.

The query can have following logic:

eval test=if(count>1,"Please check query","JOIN_SEARCH") | join test [your custom search | eval test="JOIN_SEARCH"]

Please note, the additional variable "test" in subsearch is required to join the record with first search. So, for all the events where the condition ( count > 1 ) fails, test variable in first search will get value of "JOIN_SEARCH".

Thanks!!

0 Karma

markthompson
Builder

The first point, is that the if statement only takes 3 arguments, if(condition, iftrue, iffalse).

0 Karma

jkat54
SplunkTrust
SplunkTrust

Can you please give more details? It would help to know the rest of your search string and what search command you want to append to it, etc.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...