Hi
Our client have the next (kind of query) runs as a schedule. It can found events or not, based on current situation
<base search>
| where isnotnull(joblist)
| dedup joblist
| map search="| dbxquery connection=con_A query=\"select a, b, c from xx where x='AAA'\" |appendcols [| dbxquery connection=con_A query=\"select (select max([rows]) from sys.partitions with (nolock) where object_id=object_id('dbo.$joblist$')) as rowCnt,sum(len(cast(xmlrecord as varchar(max)))) as sum from $joblist$ (nolock)\"]"
| <rest of query>
This works find where the base query found events and joblist is defined. BUT when base search cannot find any events, then the query/schedule will fail with error:
Error in 'map': Did not find value for required attribute 'joblist'.
I have tried to found answers, but couldn't found / get ideas how to skip the rest of query, starting from map, if there is no event. Any helps / ideas appreciated!
https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-where-if-a-specific-value-for-FI... This didn't work and not those where have proposed to use fillnull.
r. Ismo
Check out the new require command.
Check out the new require command.
Thanks Rich
Exactly what I'm needing, but unfortunately our Client have still version 7.3.x 😞
r. Ismo