I have a very big data set, and I want to return different fields from it, based on a value of another field (2 values possible).
if that field's (fieldA) value is 'aaa' I want to take the search to one place, and if the value is 'bbb' to another place, but at the end I want to go through the data only once.
now, I have a search for each of the options, which I concatenate them at their end:
| set of commands
| different set of commands
by that I am running on the same data twice. I want to run over the data once with something like:
| if(fieldA='aaa', set of commands, different set of commands)
I want to take care of the event differently for the two values possible of fieldA.
Is there an option to do that, or I will have to run over the data set twice?
You can try something like:
index=main | if(fieldA='aaa', [set of commands], [different set of commands])
I have given a look at that question, but it is still going through the results twice.
index=* | eval result=if( host != "myPc" , [ search index=_ | stats dc(host) as cc | return $cc] , [ search index=_ | stats c(source) as cs | return $cs] ) | table result
'search index=_' is there twice
Could you perhaps describe the overall problem statement and give some more details? It's quite likely that the community can give more complete support if we have a better understanding of your goals and a better sense of how you're trying to approach them.