Archive
Highlighted

How to make use of makeresults statement based on conditions ?

Explorer

If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition?

i.e How to make use of makeresults statement based on conditions ?

Kindly help

Tags (1)
Highlighted

Re: How to make use of makeresults statement based on conditions ?

SplunkTrust
SplunkTrust

Hi,

Do you really need to use makeresults ?

You can try something like this

| makeresults
| eval B_field=""
| append [ makeresults | eval B_field="Test"]
| eval result=if(isnull(B_field) OR B_field="","Dummy_Data",B_field)
0 Karma
Highlighted

Re: How to make use of makeresults statement based on conditions ?

Explorer
index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* 
| eval 
    [ search index= app_core sourcetype= app_log apple_cluster_name= APP_TEST is_scheduled=1 eai_acl_owner=* 
    | eval 
        [ search index= app_core sourcetype= app_log is_scheduled=1 apple_cluster_name= APP_TEST eai_acl_owner=* 
        | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
        | stats count values(dataStatus) as dataStatus dc(anotherSavedSearchUseInSearch) as rexCount 
        | eval dataStatus = if(count == 0 ,"dataDoesntExist","dataExists") 
        | eval dataStatusAndRexStatus = dataStatus.",".rexCount 
        | return dataStatusAndRexStatus ] 
    | eval dataStatus = mvindex(split(dataStatusAndRexStatus,","),0) 
    | eval rexCount = mvindex(split(dataStatusAndRexStatus,","),1) 
    | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
    | eval anotherSavedSearchUseInSearch = case(dataStatus == "dataDoesntExist","NoTitle2", rexCount == 0,"NoTitle2",rexCount > 0,anotherSavedSearchUseInSearch) 
    | stats values(anotherSavedSearchUseInSearch) as Title2 delim=" " 
    | nomv Title2 
    | return Title2]

From subsearch ——> Title2 is returning some value.

But mainsearch (index=appcore sourcetype=applog appleclustername=APPTEST isscheduled=1 eaiaclowner=* ) —> This is common ,
1. doesnt have any data in it , then it is showing error : Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression.
2. if data exists , then it doesnt thrown any error.

The query should also work when data doesnt exists.

0 Karma
Highlighted

Re: How to make use of makeresults statement based on conditions ?

Motivator

As stated in the other question (https://answers.splunk.com/answers/726353/subsearch-returns-empty-value-main-search-also-ret.html) you can use a eval Title2=coalesce(Title2,"") to ensure your subsearch returns a valid result.

0 Karma