Splunk Search

How can we add token based condition to search query ?

AKG1_old1
Builder

below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.

Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")

   <search>
        <query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
        <finalized>
          <condition match="'job.resultCount'>0">
            <set token="vmstat_earliest_token">$result.earliest$</set>
            <set token="vmstat_latest_token">$result.latest$</set>
          </condition>
          <condition match="'job.resultCount'==0">
            <unset token="vmstat_earliest_token"></unset>
            <unset token="vmstat_latest_token"></unset>
          </condition>
        </finalized>
      </search>
Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>. You can use depends to hide/execute an entire panel (and the search inside it) based on whether a token is set.

0 Karma

niketn
Legend

@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AKG1_old1
Builder

Check_Status is set through drill down in a table content.

 <table id="table1">
        <search>
           <query> Query </query>
          <earliest>-150d@d</earliest>
          <latest>now</latest>`enter code here`
        </search>
        <drilldown>
           <set token="Check_Status">LOG_DROP</set>
       </drilldown>
        <option name="count">9</option>
        <option name="drilldown">cell</option>
      </table>
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...