topic Re: How to run the main search only if the subsearch returns true? in Splunk Search

How to run the main search only if the subsearch returns true?

prakashbhanu407 — Wed, 15 Jun 2016 22:28:57 GMT

I have to run the Main search only on the last working day of the month, and I got to a search that should work, but the main search is not taking the boolean response of subsearch as a condition to process the rest of the search.

Here is my search:

index=MyIndex queryType="ts" filename=Pharmacy*.JSON [| gentimes start=-1 | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) | eval query=if(relative_time(now(),"@d")=lastWDOM,1=1,1=2) | table query] | table _time,accountName,filename,filesize

Re: How to run the main search only if the subsearch returns true?

woodcock — Wed, 15 Jun 2016 22:59:42 GMT

You cannot assign boolean values to a field. Try this:

index=MyIndex queryType="ts" filename=Pharmacy*.JSON earliest=[| gentimes start=-1 | addinfo | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),true(),lastDOM) | eval earliest=if(relative_time(now(),"@d")=lastWDOM,"Do Not Run",info_min_time) | return $earliest] | table _time accountName filename filesize

This will cause the search to crash if it does not meet your criteria.

Re: How to run the main search only if the subsearch returns true?

javiergn — Thu, 16 Jun 2016 09:21:24 GMT

You can use map to simulate a conditional execution:

| gentimes start=-1
| eval lastDOM=relative_time(now(),"+1mon@mon-1d") 
| eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"), strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) 
| eval n_searches=if(relative_time(now(),"@d")=lastWDOM, 1, 0)
| where n_searches > 0
| map maxsearches=1 search="
    | search index=MyIndex queryType=\"ts\" filename=Pharmacy*.JSON 
    | table _time,accountName,filename,filesize
"

Re: How to run the main search only if the subsearch returns true?

somesoni2 — Thu, 16 Jun 2016 16:35:11 GMT

Try like this

index=MyIndex queryType="ts" filename=Pharmacy*.JSON [| gentimes start=-1 | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) | eval index=if(relative_time(now(),"@d")=lastWDOM,"MyIndex","YouWillNotFindThisIndex") | table index] | table _time,accountName,filename,filesize

Basically, if the subsearch condition is false, it'll return a value for field (metadata field used for better performance) index which may never exist so main search will not run. It returns the same index name as main search in case the condition is true.

Re: How to run the main search only if the subsearch returns true?

ibob0304 — Thu, 04 May 2017 02:34:14 GMT

I couldn't thank much on using map, it solved my long standing issue.. thanks alot..