Splunk Search

Splunk If else and severity search query

puneetkharband1
Path Finder

I am trying to write splunk search where I have 2 conditions and my query returns the results based on that 

for example if condition1 matches create a new field (SEVERITY)=SEV2
if condition 2 matches SEVERITY=SEV2 
else SEVERITY=SEV3

How can I achieve this ...In my search string I am using couple of fields to filter the data putting that as SEV2 criteria ...I am able to filter it but and get the results for both the conditions but I am stuck where I cannot call everything else as SEV3

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

 

| eval SEVERITY=if(condition1,"SEV2",if(condition2,"SEV2","SEV3"))

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

 

| eval SEVERITY=if(index=abc AND sourcetype=QWE AND action=XYZ, "SEV2", if(NOT (test=blabla AND action=xyz), "SEV2", "SEV3"))

 

 

Can you give an example of your current queries for a little context to what you are asking for?

0 Karma

puneetkharband1
Path Finder

not sure you understood my question ...thanks for looking into that ....but how to define the condition in the search thats where I am getting confused 

Condition 1
Index=abc sourcetype=QWE
action=XYZ 
OR
condition2
NOT (test=blablaand action=xyz) 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...