Splunk Search

nested if loop

splunkymage
Observer

I would like to write in splunk a nested if loop: What I want to achieve:

if buyer_from_France: 

                   do eval percentage_fruits

                   if percentage_fruits> 10:

                                                         do summation

                                                         if summation>20:

                                                                                          total_price

                                                                                           if total_price>$50:

                                                                                                                      do(trigger bonus coupon)

My current code (that works):

> | eventstats sum(buyers_fruits) AS total_buyers_fruits by location

> | stats sum(fruits) as buyers_fruits by location buyers

> | eval percentage_fruits=fruits_bought/fruits_sold

> | table fruits_bought fruits_sold buyers

> | where percentage_fruits > 10

> | sort - percentage_fruits

How do I complete the syntax/expression for the 2nd (summation) and consequently, 3rd (total price), 4th if-loop (trigger)?

Labels (5)
0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...