Monitoring Splunk

How do I search results that depend on the subsearch being empty?

damucka
Builder

Hello,

I have following search:

index=mlbso sourcetype=BWP_hanatraces earliest=1543313122.531 latest=1543313122.537 [search index=mlbso sourcetype=BWP_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=1543313122.531 latest=1543313122.537 | rex field=_raw "(?i)(?<=configuration is changed by )(?P<CONNECTION_ID>(?s)(.*))(?=, client ip)" | return $CONNECTION_ID]

Now, it works fine when the subsearch returns a value back to the outer search.

However when the subsearch does not return anything back (no proper value is found) then the outer search is not restricted with the subsearch and it returns too many events.

How would I achieve the whole search returning no events based on the subsearch being empty?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=mlbso sourcetype=BWP_hanatraces earliest=1543313122.531 latest=1543313122.537
[search index=mlbso sourcetype=BWP_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=1543313122.531 latest=1543313122.537
| rex field=_raw "(?i)(?<=configuration is changed by )(?P<CONNECTION_ID>(?s)(.*))(?=, client ip)"
| appendpipe [|makeresults | eval CONNECTION_ID="THIS_STRING_WILL_NOT_BE_IN_ANY_OF_YOUR_EVENTS"]
| head 1
| return $CONNECTION_ID]

View solution in original post

woodcock
Esteemed Legend

Like this:

index=mlbso sourcetype=BWP_hanatraces earliest=1543313122.531 latest=1543313122.537
[search index=mlbso sourcetype=BWP_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=1543313122.531 latest=1543313122.537
| rex field=_raw "(?i)(?<=configuration is changed by )(?P<CONNECTION_ID>(?s)(.*))(?=, client ip)"
| appendpipe [|makeresults | eval CONNECTION_ID="THIS_STRING_WILL_NOT_BE_IN_ANY_OF_YOUR_EVENTS"]
| head 1
| return $CONNECTION_ID]