topic How to edit my eval syntax to check if the value "No results found." exists? in Splunk Search

How to edit my eval syntax to check if the value "No results found." exists?

email2vamsi — Tue, 29 Sep 2020 12:00:24 GMT

|eval final = if(running_ok==" " OR running_ok==1,1,0)

I want to assign final=1 when (running_ok=="No results found." OR running_ok==1).

Running_ok==1 works fine, but it does not work when running_ok=="No results found."
Please let me know what needs to be used on the RHS when search returns no values.

Re: How to edit my eval syntax to check if the value "No results found." exists?

sundareshr — Wed, 30 Nov 2016 12:41:29 GMT

Try this

.... | eval final=if(match(running_ok, "No results") OR running_ok=1, 1, 0) | ...

Re: How to edit my eval syntax to check if the value "No results found." exists?

richgalloway — Wed, 30 Nov 2016 12:42:03 GMT

How about this?

|eval final = if(isnull(running_ok) OR running_ok==1,1,0)

Re: How to edit my eval syntax to check if the value "No results found." exists?

email2vamsi — Thu, 01 Dec 2016 11:26:29 GMT

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv

I am using join on two sourcetypes for the field "running_ok".
The following table is derived based on how the inner join functions.

(Main search "running_ok" result),(Sub search "running_ok" result)= 0 or 1 or Blank(Join Search returned no values.)
0,0=0 (Running)
1,0= blank (Not Running)
0,1= blank (Not Running)
1,1=1 (Not Running)

|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok=="Join search returns no values." OR running_ok==1,1,0)

From the above i am able to assign required value for "final" when running_ok=0 or 1.
But I could not assign value for "final" when "Join search returns no values."

Re: How to edit my eval syntax to check if the value "No results found." exists?

richgalloway — Thu, 01 Dec 2016 13:17:43 GMT

One has to force a search to return a response when there are no events that match. The appendpipe command is often used for that. Try this updated query.

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | appendpipe [ stats count | eval monitor_status="Not running" | where count==0 | fields - count ] | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv