Splunk Search

Conditional search

Bulluk
Path Finder

I have 2 fields that I need to search on - Field1 and Field2. Most of the time I only want to search on Field1 but occasionally it contains a value which means I need to also search for Field2. I have a rex statement which populates a variable when Field1 contains the keyword so I need my search to look like this:

rex KeywordFound=(find the key word) |
if KeywordFound is null search for Field1
else search for Field1 and Field2 |

Can this kind of conditional search be done with Splunk?

Thanks

Tags (3)
0 Karma
1 Solution

Ayn
Legend

Do you need just to search for the general existence of Field1 and Field2?

I imagine you could use a subsearch to accomplish this. You start off the outer search with searching for Field1 and then use the subsearch for adding a search for Field2 if the subsearch finds the keyword. Something like this:

Field1=* [search * | rex (?<KeywordFound>blahblah) | search KeywordFound=* | head 1 | eval query="Field2=*" | fields query]

View solution in original post

Ayn
Legend

Do you need just to search for the general existence of Field1 and Field2?

I imagine you could use a subsearch to accomplish this. You start off the outer search with searching for Field1 and then use the subsearch for adding a search for Field2 if the subsearch finds the keyword. Something like this:

Field1=* [search * | rex (?<KeywordFound>blahblah) | search KeywordFound=* | head 1 | eval query="Field2=*" | fields query]

Bulluk
Path Finder

I'm not completely following your logic but you post has given me an idea that should work. When KeywordFound is null I'll evaluate Field2 to a wildcard so that all events match, meaning the only field actually being used in the search is Field1.

I'm off to try out the theory. If it works I shall award the points 🙂

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...