https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477582#M143368 <P>I have 2 situations to address..<BR /> 1. if no data in index for timeframe , create a blank row with "no data" and come out of query<BR /> 2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.</P> <P>can both of these be achieved in a single query.<BR /> basically search index for data, if data not found, create "nodata" row, exit,<BR /> else if data found, but no results on eval, then create "0" row ...</P> <P>hope i am clear with my question.</P> Sat, 22 Feb 2020 10:49:15 GMT jiaqya 2020-02-22T10:49:15Z https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477582#M143368 <P>I have 2 situations to address..<BR /> 1. if no data in index for timeframe , create a blank row with "no data" and come out of query<BR /> 2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.</P> <P>can both of these be achieved in a single query.<BR /> basically search index for data, if data not found, create "nodata" row, exit,<BR /> else if data found, but no results on eval, then create "0" row ...</P> <P>hope i am clear with my question.</P> Sat, 22 Feb 2020 10:49:15 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477582#M143368 jiaqya 2020-02-22T10:49:15Z https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477583#M143369 <P>There is no concept of "come out of query" in SPL. All queries run to the end.</P> <P>To add "no data" to your query, use <CODE>appendpipe</CODE> near the end.</P> <PRE><CODE>... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ] </CODE></PRE> Sat, 22 Feb 2020 13:06:51 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477583#M143369 richgalloway 2020-02-22T13:06:51Z https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477584#M143370 <P>i saw the append pipe fix , but was wondering if anybody knew any other trick to get this working..<BR /> this fix helps me get things going...</P> <P>i wish , if then else statements worked with spl the same way they work in other languages..</P> <P>thanks..</P> Sat, 22 Feb 2020 13:37:38 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477584#M143370 jiaqya 2020-02-22T13:37:38Z https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477585#M143371 <P>Go to <A href="https://ideas.splunk.com">https://ideas.splunk.com</A> to submit a feature request.</P> Sat, 22 Feb 2020 17:59:12 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-no-data-in-index-quot-no-results-found-quot/m-p/477585#M143371 richgalloway 2020-02-22T17:59:12Z