Splunk Search

how can i search an existing value from resultsearch on index?

sfatnass
Contributor

hello everybody,

i'm trying to fetch if a value existing on index or not.

after search result i get a new filtering fields and i want to know if i can use |eval test=if(index,"exist","notexist").

my exemple search::
index=A
|field blabla1 blabla2 blabla3
[dbquery "DB" "select..........." |fields + blabla]
[dbquery "DB" "select .........." |fields + blabla2]

|eval test=if(index=B,blabla3,"KO") ==> here is my problem

if any body have any idea thx

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you have explicitly discluded the thing you are testing. Your search starts out with index=A so all of your initial results set will have ONLY index values of A. You then later say if(index=B) which will ALWAYS be false. You need to start out with something broader like (index=A) OR (index=B).

View solution in original post

0 Karma

woodcock
Esteemed Legend

The problem is that you have explicitly discluded the thing you are testing. Your search starts out with index=A so all of your initial results set will have ONLY index values of A. You then later say if(index=B) which will ALWAYS be false. You need to start out with something broader like (index=A) OR (index=B).

0 Karma

vganjare
Builder

Can you please explain more about the problem? Try to create an example using _internal index.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...