topic Re: How to return stats from subsearch if first search returns no events in Splunk Search

How to return stats from subsearch if first search returns no events

rune_hellem — Mon, 24 Jan 2022 06:56:31 GMT

I have created a search that will trigger if no events from the following search is being returned

index=ipl_prod source="e:\\logs\\icc-application.log" sourcetype="log4j:ipl" operationName=hentOpptjeningsperioder status=OK

Search is only being triggerd during business hours Monday to Friday, problem is that I cannot instruct the cron schedule to not trigger on holidays. Holidays means no activity, so to make it a bit easier to evaluate if this is a false positive or not I want to add to the email being sent statistics of all statuses. Then we know if no other statuses has been found either, it is safe to ignore.

index=ipl_prod source="e:\\logs\\icc-application.log" sourcetype="log4j:ipl" operationName=hentOpptjeningsperioder status=OK [if no eventes then subsearch and return those events]

Re: How to return stats from subsearch if first search returns no events

gcusello — Mon, 24 Jan 2022 07:22:47 GMT

Hi @rune_hellem,

let me understand: you want to exclude results i holidays to avoid false positives, is it correct?

if this is your need, I solved this problem using a lookup containing all the holidays of the week, something like this:

day fest 2022-01-01 0 2022-01-02 0 2022-01-03 1 2022-01-04 1 2022-01-05 1 2022-01-06 0 2022-01-07 1 2022-01-08 0 2022-01-09 0 2022-01-10 1 and so on

in this way you can a condition to your search to be sure that in week-ends and holidays you don't have results, something like this:

index=ipl_prod source="e:\\logs\\icc-application.log" sourcetype="log4j:ipl" operationName=hentOpptjeningsperioder status=OK | eval day=strftime(_time,"%Y-%m-%d") | lookup calendar.csv day OUTPUT fest | search fest=1 | ...

Ciao.

Giuseppe

(called e.g. calendar.csv)

Re: How to return stats from subsearch if first search returns no events

ITWhisperer — Mon, 24 Jan 2022 07:56:07 GMT

| appendpipe [stats count as _rows | where _rows=0 | eval status="no rows found"]