Splunk Search

How can we add token based condition to search query ?

AKG1_old1
Builder

below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.

Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")

   <search>
        <query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
        <finalized>
          <condition match="'job.resultCount'>0">
            <set token="vmstat_earliest_token">$result.earliest$</set>
            <set token="vmstat_latest_token">$result.latest$</set>
          </condition>
          <condition match="'job.resultCount'==0">
            <unset token="vmstat_earliest_token"></unset>
            <unset token="vmstat_latest_token"></unset>
          </condition>
        </finalized>
      </search>
Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>. You can use depends to hide/execute an entire panel (and the search inside it) based on whether a token is set.

0 Karma

niketn
Legend

@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AKG1_old1
Builder

Check_Status is set through drill down in a table content.

 <table id="table1">
        <search>
           <query> Query </query>
          <earliest>-150d@d</earliest>
          <latest>now</latest>`enter code here`
        </search>
        <drilldown>
           <set token="Check_Status">LOG_DROP</set>
       </drilldown>
        <option name="count">9</option>
        <option name="drilldown">cell</option>
      </table>
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...