Splunk Search

If Else functionality to pick different subsearch

pbarbuto
Path Finder

Depending on what month it is I need to run a different sub-search.

index=foo source=bar
    [| inputlookup servers.csv where myfield="this" 
    | eval nowMonth=strftime(now(), "%m") 
    | where nowMonth=06
    | eval host=name
    | fields host] 
    [| inputlookup servers.csv where myfield="that" 
    | eval nowMonth=strftime(now(), "%m") 
    | where nowMonth!=06 
    | eval host=name
    | fields host]

So basically if its the current month I want to run the first inputlookup, and if its NOT the current month I want to run the 2nd inputlookup. is this doable?

Tags (1)
0 Karma

FrankVl
Ultra Champion

Think that can be done in one go, like this:

index=foo source=bar
     [| inputlookup servers.csv  
     | eval nowMonth=strftime(now(), "%m") 
     | eval choice = if(nowMonth="06","this","that")
     | where myfield=choice
     | eval host=name
     | fields host] 
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...