Empty result subsearch in eval/case

[csocha]

I am trying to eval a new field based on matching several sub searches. The issue is that these sub searches can potentially return an empty result which breaks the syntax of the eval command. Example:

index=A loglevel=error 
| eval group=case(
[search  "search string 1" | fields correlationField], "group 1",   
[search  "search string 2" | fields correlationField], "group 2"
1=1, "other")

In this example if "search string 1" is not found in the time range then an empty result is used for the condition for group 1, which causes an error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')

[somesoni2]

If you're just setting group value based on which search string returns results (and not passing the actual value from subsearch), you can try like this

index=A loglevel=error 
 | eval group=case(
 [search  "search string 1" | stats count as search ]>0, "group 1",   
 [search  "search string 2" | stats count as search]>0, "group 2",
 1=1, "other")

You can also try this

index=A loglevel=error
| appendcols [search  "search string 1" | stats count by correlationField | table correlationField | rename correlationField as group1]
| appendcols [search  "search string 2" | stats count by correlationField | table correlationField | rename correlationField as group1]
| eval group=case(isnotnull(group1),"group1", isnotnull(group2),"group2", 1=1,"other")

[richgalloway]

You'll need to add to your subsearch so there's always a correlationField. Maybe this will help.

index=A loglevel=error 
| eval group=case(
[search  "search string 1" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 1",   
[search  "search string 2" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 2"
1=1, "other")

[csocha]

This has the same problem. The issue isn't results without a correlationField, it's that the subsearch might return no results at all.