Splunk Search

Search inside Eval if statement possible ?

crt89
Communicator

Is it possible to put search inside an eval if statement ? I am making a search that if the count of the field is greater than 1 it would display "Please check your query" then if its equal to 1 it will proceed to my search..

 eval test=if(count>1,"Please check query",count==1,*search command goes here*

Is the eval if statement the thing to use ?

0 Karma

vganjare
Builder

Hi,

You can try using join.

The query can have following logic:

eval test=if(count>1,"Please check query","JOIN_SEARCH") | join test [your custom search | eval test="JOIN_SEARCH"]

Please note, the additional variable "test" in subsearch is required to join the record with first search. So, for all the events where the condition ( count > 1 ) fails, test variable in first search will get value of "JOIN_SEARCH".

Thanks!!

0 Karma

markthompson
Builder

The first point, is that the if statement only takes 3 arguments, if(condition, iftrue, iffalse).

0 Karma

jkat54
SplunkTrust
SplunkTrust

Can you please give more details? It would help to know the rest of your search string and what search command you want to append to it, etc.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...