topic Re: Eval subsearch give error when result not found in Splunk Search

Eval subsearch give error when result not found

salt87 — Thu, 08 Aug 2019 01:08:09 GMT

Hi,

my search is the following

| inputlookup genesis.csv

| eval _time=now()
| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1| return $count]

| outputlookup blabla.csv

This works when the subsearch returns a value, however it gives me an error when the subsearch return "No Result Found"

Is there something I can do to replace the error by the value "0"

thanks

Re: Eval subsearch give error when result not found

MuS — Thu, 08 Aug 2019 02:23:21 GMT

Hi salt87,

give this a try:

| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1
| appendpipe 
    [| stats count 
    | where count=0]| return $count]

all this does is it will return something even you have no match. In the case of no match it will have count = 0 as result.

Hope this helps ...

cheers, MuS

Re: Eval subsearch give error when result not found

salt87 — Thu, 08 Aug 2019 03:07:07 GMT

You're a legend mate.