topic Re: How to handle "no results found" in subsearch in Splunk Search

How to handle "no results found" in subsearch

tsa_asap — Thu, 26 Mar 2020 10:18:31 GMT

Hi all,

I have a subsearch that returns me the delta between two events. The problem is, sometimes the two events I´m looking for don´t exist. This results in the following Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

The subsearch looks like this:

| eval DisruptionInSeconds = [ my subsearch that returns the delta between two events 
| sort - _time 
| stats sum(timeDeltaS) as search | eval search ="\"".search."\"" ]

If these two events don´t exist, the search should return 0 (not NULL). How do I do that?

Thanks in advance for your help.

Re: How to handle "no results found" in subsearch

richgalloway — Thu, 26 Mar 2020 13:04:38 GMT

Use appendpipe.

| eval DisruptionInSeconds = [ my subsearch that returns the delta between two events 
| sort - _time 
| stats sum(timeDeltaS) as search | eval search ="\"".search."\"" 
| appendpipe [ stats count | eval search="0" | where count==0 | fields - count ] ]

Re: How to handle "no results found" in subsearch

tsa_asap — Thu, 26 Mar 2020 13:08:05 GMT

That works. Thanks!