Hi,
I have a very big data set, and I want to return different fields from it, based on a value of another field (2 values possible).
if that field's (fieldA) value is 'aaa' I want to take the search to one place, and if the value is 'bbb' to another place, but at the end I want to go through the data only once.
now, I have a search for each of the options, which I concatenate them at their end:
index=main fieldA='aaa'
| set of commands
and
index=main fieldA='bbb'
| different set of commands
by that I am running on the same data twice. I want to run over the data once with something like:
index=main
| if(fieldA='aaa', set of commands, different set of commands)
I want to take care of the event differently for the two values possible of fieldA.
Is there an option to do that, or I will have to run over the data set twice?
Hi,
You can try something like:
index=main
| if(fieldA='aaa', [set of commands], [different set of commands])
Refer this links:
https://answers.splunk.com/answers/229204/how-to-write-a-search-where-if-a-specific-value-fo.html
I have given a look at that question, but it is still going through the results twice.
index=*
| eval result=if( host != "myPc" ,
[ search index=_
| stats dc(host) as cc
| return $cc] ,
[ search index=_
| stats c(source) as cs
| return $cs] )
| table result
'search index=_' is there twice
Could you perhaps describe the overall problem statement and give some more details? It's quite likely that the community can give more complete support if we have a better understanding of your goals and a better sense of how you're trying to approach them.
edited the question, I think that now it has a deeper explanation of the problem