Splunk Search

How to edit my eval statement to produce results from 1 of 2 source types, not both?

bluemarvel
Path Finder

I have made an inquiry on having a subsearch that will allow the user to:
1) within one index, search two different sourcetypes for an item (url and/or host)
2) if the item is found in sourcetype(A) then sourcetype(B) is ignored
3) if the item is found in sourcetype(B) then sourcetype(A) is ignored
4) produce the search result
5) sourcetype (A) is the primary (B) is the secondary

the search string below works but produces search results from both sourcetypes

index=*   sourcetype=(A)  OR sourcetype=(B) | eval search=case(sourcetype == (A), "true", sourcetype == (A), "false" , 1=1, "true") 
| search "url=" OR "dest_nt_host=*" | eval search=if(isnull(url),elsefield,dest_nt_host)
0 Karma

sundareshr
Legend

Do the two sourcetypes have any common fields to match them on?

0 Karma

cmerriman
Super Champion

if you changed your eval to this:

| eval search=if(sourcetype == (A), "true",  "false" ) 

does it evaluate correctly?

0 Karma

bluemarvel
Path Finder

the result is the same either way

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...