Splunk Search

how can i search an existing value from resultsearch on index?

sfatnass
Contributor

hello everybody,

i'm trying to fetch if a value existing on index or not.

after search result i get a new filtering fields and i want to know if i can use |eval test=if(index,"exist","notexist").

my exemple search::
index=A
|field blabla1 blabla2 blabla3
[dbquery "DB" "select..........." |fields + blabla]
[dbquery "DB" "select .........." |fields + blabla2]

|eval test=if(index=B,blabla3,"KO") ==> here is my problem

if any body have any idea thx

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you have explicitly discluded the thing you are testing. Your search starts out with index=A so all of your initial results set will have ONLY index values of A. You then later say if(index=B) which will ALWAYS be false. You need to start out with something broader like (index=A) OR (index=B).

View solution in original post

0 Karma

woodcock
Esteemed Legend

The problem is that you have explicitly discluded the thing you are testing. Your search starts out with index=A so all of your initial results set will have ONLY index values of A. You then later say if(index=B) which will ALWAYS be false. You need to start out with something broader like (index=A) OR (index=B).

0 Karma

vganjare
Builder

Can you please explain more about the problem? Try to create an example using _internal index.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...