Splunk Search

Search using IF statement

tech_soul
New Member

Hi All,

Could you please help me with " if "query to search a condition is true then need to display some values from json format .
please i m brand new to splunk ..

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tech_soul,
without othe information is difficoult to help you! could you share more information?

Anyway, you can use the if condition in an eval command to set a variable to use for searches, for additioan information see https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/ConditionalFunctions .

E.g. if I want to set a value OK if a field has a value less than 100 and NOK if the value is more than 100, you could create a search like this:

index=my_index
| eval my_check=if(my_field>100,"NOK","OK")
| table _time my_check

Then you can use this value for additional conditions as search or where.

Bye.
Giuseppe

LizAndy123
Path Finder

I have a question

I Did this on an event and basically did the If command - that if above 15 mins then Output is BAD and if under 15 the. output is GOOD - This works.

My question is I now want to search only the BAD and alert - so guess how do I start another search after I have run eval and got my BAD output?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

FWIW, it's usually better to ask a new question than to pile on to a 4-year-old thread.

To keep only the BAD events, try one of these

index=my_index
| eval my_check=if(my_field>100,"NOK","OK")
| where my_check="NOK"
| table _time my_check

or

index=my_index
| where my_field>100
| table _time my_field

 

 

---
If this reply helps you, Karma would be appreciated.

yshen
Communicator

Thanks for the concise example of if expression.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...