if statement to output multiple tables in splunk?
For example I have 3 tables that have the following data
Table 1
AA 1.1
AA1.5
BB 2.1
CC 3.1
AA 1.3
AA 1.4
Table 2
AA 1.1
AA1.8
BB 2.1
CC 3.1
AA 1.3
AA 1.7
Table 3
AA 1.4
AA1.5
BB 2.6
CC 3.7
AA 1.4
AA 1.5
How can i search for AA so i get the output in the form of 3/2/1 different tables depending on what the query is?
Also is there a way to call for a specific set of queries if one of the fields match
for example i want to create a search query that
if today is monday please search for aa
if today is tuesday please search for bb
Can i have an if statement call multiple table IDs for multiselect option?
PS. I have the data in an excel sheet that i cannot deploy to splunk
If the data cannot be in Splunk then how do you expect to use Splunk to search it?
the tables are present is splunk.
is there a way to have an if statement call for different table IDs?
SPL does not support conditional execution like in high-level programming languages. Commands are executed consecutively from beginning to end.
Dashboards, however, may be able to do what you seek. One can create a dashboard with several panels (queries). Each panel can be hidden or displayed based on the absence or presence of a token. The tokens are set based on some input, which usually is selected by the user, but it can be a search that returns the current day of the week.
Does that sound like it's what you need?
Hiding panels was a great idea. thanks.
search Items NOT present in Index
for example
if day = Mon,tues,wed
output query1 and query3 (as two separate tables)
if day = thur,friday
output query4 and query5 (as two separate tables)
if day = Mon,friday
output query1 (as one separate table)
if day = Mon,wed,friday
output query2, query3 and query5 (as three separate tables)