Splunk Search

Execute a Search if the condition is met else not

jugalkinariwala
Explorer

Hi Splunkers,

 

I am writing on SPL in the report which has lookup. And if the lookup has less number of rows then overwrite the lookup with existing static lookup.

 

Example:

<myseach>
| outputlookup test1.csv
| stats count
| < if/where condition , where i need to check if the count < 100 , then overwrite existing static lookup into test1.csv else remain as-is"
                         count < 100 , "| inputlookup testlookup.csv | outputlookup test1.csv" , "test1.csv" 


Labels (1)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...