topic Re: return command - exit (or return known value) if no results found in Splunk Search

return command - exit (or return known value) if no results found

thewer — Fri, 31 May 2013 08:08:53 GMT

I have a search that is basically (there are actually 2 sub searches, but this makes it easier to understand):

index="weblogs" [ SEARCH index="custcomplaintlogs" earliest=-1d | return 50 $custsession ]

This normally returns the weblogs that contain any of the customer sessions where the customers complained (ie: find what the complaining customer actually did on the site). However when there are no results in "custcomplaintlogs" over the last day it returns EVERYTHING from "weblogs". If there is something in "custcomplaintlogs" it will give the weblogs for the customers session only.

How can I stop it returning everything if the subsearch has no results. I want to either exit, or return something that will match nothing in the weblogs.

Re: return command - exit (or return known value) if no results found

cramasta — Fri, 31 May 2013 20:06:45 GMT

Not sure if there is a better way, but what if you did something like this

This will basically just add another value to custsession which will never be found in splunk. If your subsearch doesn't return any values with the return command it will at least always return NeverEverGonnaFindMeInSplunk which will stop the main search from searching for everything

Re: return command - exit (or return known value) if no results found

thewer — Tue, 04 Jun 2013 06:53:51 GMT

Not sure if that syntax is quite correct, but the idea works and I cant find anything better - thanks cramasta!

Re: return command - exit (or return known value) if no results found

cramasta — Tue, 04 Jun 2013 13:51:06 GMT

Yeah forgot an additional end bracket at the end of the fields command. I updated the post.

Re: return command - exit (or return known value) if no results found

unchura — Wed, 14 Dec 2016 19:57:37 GMT

thanks! it worked by eval new row with 0 value and put it at the and of the resulting table, requesting "head 1". Then if the search is empty then only that last 0 come that I can take within the rest of the code.

i.e

index="myIndex" | where pString = "xyz" | append [ | stats count | fields - count | eval pString = 0  ] | eval recs=if(pString=0,0,1) | sort recs DESC | head 1 | table pString

Re: return command - exit (or return known value) if no results found

jkat54 — Fri, 14 Apr 2017 14:29:53 GMT

Would probably be better if you did this instead: