Splunk Search

if statement to output multiple tables in splunk?

ashidhingra
Path Finder

if statement to output multiple tables in splunk?

For example I have 3 tables that have the following data
Table 1 
AA 1.1 
AA1.5
BB 2.1
CC 3.1
AA 1.3
AA 1.4


Table 2
AA 1.1 
AA1.8
BB 2.1
CC 3.1
AA 1.3
AA 1.7

Table 3
AA 1.4
AA1.5
BB 2.6
CC 3.7
AA 1.4
AA 1.5

How can i search for AA so i get the output in the form of 3/2/1 different tables depending on what the query is?

Also is there a way to call for a specific set of queries if one of the fields match
for example i want to create a search query that
if today is monday please search for aa
if today is tuesday please search for bb

Can i have an if statement call multiple table IDs for multiselect option?

PS. I have the data in an excel sheet that i cannot deploy to splunk

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the data cannot be in Splunk then how do you expect to use Splunk to search it?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ashidhingra
Path Finder

the tables are present is splunk. 

is there a way to have an if statement call for different table IDs?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

SPL does not support conditional execution like in high-level programming languages.  Commands are executed consecutively from beginning to end.

Dashboards, however, may be able to do what you seek.  One can create a dashboard with several panels (queries).  Each panel can be hidden or displayed based on the absence or presence of a token.  The tokens are set based on some input, which usually is selected by the user, but it can be a search that returns the current day of the week.

Does that sound like it's what you need?

---
If this reply helps you, Karma would be appreciated.

ashidhingra
Path Finder

Hiding panels was a great idea. thanks.

0 Karma

ashidhingra
Path Finder

search Items NOT present in Index
for example
if day = Mon,tues,wed
output query1 and query3 (as two separate  tables)
if day = thur,friday
output query4 and query5 (as two separate  tables)
if day = Mon,friday
output query1 (as one separate  table)
if day = Mon,wed,friday
output query2, query3 and query5 (as three separate  tables)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...