help with counting search events / output needed

damucka — Tue, 04 Feb 2020 12:38:14 GMT

Hello,

I need a help with counting the search results.
I cannot use the following:

| stats count as Total

because the stats command destroys my output that I got from the database. On the simple example:

| noop search_optimization=false| dbxquery query="
select now() from dummy
" connection="HANA_MLBSO"

| stats count as Total

I get only a Total under the Statistics tab as a result, otherwise the date coming from now().
My goal is to trigger the custom command at the end of search, but only then if the search returned any results, be it events or dbxquery output. Something like that:

index=mlbso sourcetype=isp_hanatraces secondary

| stats count as Total

| where Total > 0 

| eval SEVERITY = 3
| eval AlertSource = "SPLUNK"
| eval AlertText = "Test"
| eval  ShortText = "HANA crash" 
| eval SID = "SID"
| eval DB = "DBSID"
| eval host = host
| eval _time = "TIME"
| mycommand

So, for the example above it would maybe even work as there are events returned, but for the DB output of the dbxquery not.

Is there any elegant way to check if the result returned is not empty without deploying stats?

Kind REgards,
Kamil

Re: help with counting search events / output needed

richgalloway — Tue, 04 Feb 2020 14:32:20 GMT

Try stats count as Total, values(*) as *.

Re: help with counting search events / output needed

somesoni2 — Tue, 04 Feb 2020 14:33:35 GMT

Add below after your stats command.

| appendpipe [| stats count as Total| where Total=0 ]

topic Re: help with counting search events / output needed in Splunk Search

help with counting search events / output needed

Re: help with counting search events / output needed

Re: help with counting search events / output needed