topic Re: Search returns "No results found", when it should be returning 1. in Splunk Search

Search returns "No results found", when it should be returning 1.

griffinpair — Mon, 09 Oct 2017 21:30:56 GMT

The search below looks for an event for a specific client during a specific time. If the event is not there, I would want to be notified, thus a "1" should be returned.

There is no event, so noNull is 0. The case statement "end" should be "1-0" (1-noNull), so 1 should be returned. However, I get "No results found." FYI: the search does work is noNull is 1.

source=*D:\\FHSO\\imports* source=*daily\\imports* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| where ClientID="WHI"
| where ((like(source,"%"."WHI"."%")) AND time>"02:00:00" AND time<"02:25:00")
| stats count as lateEnds 
| eval noNull = if(ISNULL(lateEnds),0,lateEnds)
| eval end = case(ClientID="WHI", 1-noNull ) | table end

Re: Search returns "No results found", when it should be returning 1.

justinatpnnl — Mon, 09 Oct 2017 21:42:58 GMT

A couple of things:

Line 5 will return a zero if there are no results, so line six isn't necessary.
Line 7 will never return anything because it is a case statement which requires a ClientID field that equals "WHI". The stats command in line 5 got rid of that field. To get that to evaluate the way you want, change line 7 to | eval end = 1 - lateEnds

Re: Search returns "No results found", when it should be returning 1.

gcusello — Tue, 10 Oct 2017 07:32:33 GMT

Hi griffinpair,
try something like this

source="*D:\FHSO\imports*" source="*daily\imports*" End earliest=-30h@h ClientID="WHI"
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| eval isEvent=if(like(source,"%"."WHI"."%") AND time>"02:00:00" AND time<"02:25:00",1,0)
| stats count as myCount sum(isEvent) AS isEvent
| eval noNull=if(isEvent>0, isEvent, myCount)
| eval end = case(ClientID="WHI","1-"+noNull)
| table end

The main search is strange because you used two conditions for source connected by AND clause: running only the main search have you results?.

Bye.
Giuseppe
P.S.: add always index in your search, is quicker!