Splunk Search

how to deal with the 2 conflict conditions on where


I have a query to send an alert, which have 2 conflict conditions:

|where alarm=1 
generate some sum information only for alarm happens

|where alarm=0

do something for cleaning the alarm

|table *
But I only can do one of them, If I put where alarm=1 first, then I only can generate the alarm, otherwise, only can do clean alarm.

If I put where alarm=1 OR alarm=0, it cannot generate some sum information for the alarm data. For example |eventstats list(x) etc.

Any suggestion? Thanks in advance.



Labels (1)
0 Karma


Please provide some sample events for better understanding your scenario.

In general, you should be able to do conditional stats


stats count(eval((field1 != field2)
Happy Splunking!
0 Karma



The problem becomes how can get a list values with the condition?  for example, I need to get some values lists where alarm=1, but I also need to deal with alarm=0

| where alarm=1 OR alarm=0

|eventstats list(create_session) as create_session list(Dn) as Dns by _time  //ONLY alarm==1
|evenststa list (IPs) as IPs by _time   //ONLY alarm==0

|table IPs create_session DNs

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...