To create a dynamic report using eval splunk.

[tvon1990]

|eval Actual_Start_Time=[search index=index ESP_JOB=$Start_Job$ JOB_STATUS=EXEC|return $_time]
how to write if condition to return _time if the serach returns result or hardcode 00:00

[DalJeanis · Accepted solution]

Basically, you just adjust your internal search until you are happy with the results, then put it back into your subsearch.

For example, your current subsearch, as a search, would be ...

  index=index ESP_JOB=$Start_Job$ JOB_STATUS=EXEC
 |table _time

You need to make sure you are getting exactly one record, and then if it has nothing in it, you want to override the value. There are lots of ways to do this, but here's one

  index=index ESP_JOB=$Start_Job$ JOB_STATUS=EXEC
 | head 1
 | stats count as mycount first(_time) as _time 
 | eval _time=if(count=0,0,_time)
 | table _time

Since splunk defaults to return records most recent first, that will return the _time of the most recent matching record, or it will return 0 if there are no matching records.

Now, we wrap that in your square braces and it should work.

|eval Actual_Start_Time=[index=index ESP_JOB=$Start_Job$ JOB_STATUS=EXEC
     | head 1
     | stats count as mycount first(_time) as _time 
     | eval _time=if(count=0,0,_time)
     | return $_time]