Error in eval command for subsearch returning no results

[systemjack]

I have a subsearch that may or may not return results on an hourly basis. I'm trying to capture the resulting value in an eval statement for later use, but the overall search errors out with "Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression" when the subsearch returns no results. Otherwise things work fine.

The search is similar to:

index="foo" | eval [search index=hourly_summary `additional_filters` | head 100
| stats max(bean_count) as max_count | fields + max_count 
| format "" "" "AND" "" "OR" ""]
| `more_stuff_using_max_count`

What I'd really like to be able to do is populate max_count with a default value when the subsearch doesn't return results using fillnull or similar. Is there a way to force at least one default result?

[dwaddle · Accepted solution]

This is insanely ugly, but it appears to do what you want.

index="foo" | eval max_count=[ search index=hourly_summary `additional_filters` | head 100
| stats max(bean_count) as max_count | fields query 
| format "" "" "" "" "" "" 
| rex mode=sed field=search "s/NOT \(\)/default_value" ]
| `more_stuff_using_max_count`

Here is another option of which I am slightly less embarrassed:

index="foo" | eval [search index=hourly_summary `additional_filters` | head 100
| stats max(eval(coalesce(bean_count,0))) as max_count | fields + max_count 
| format "" "" "AND" "" "OR" ""]
| `more_stuff_using_max_count`

[carasso]

forget the 'fields' or 'format' commands, just use 'return':

index="foo" 
| eval [search index=hourly_summary `additional_filters` 
                | head 100 
                | stats max(eval(coalesce(bean_count,0))) as max_count 
                | return max_count 
     ] 

you can test this with this search ("|stats count" just makes a dummy event):

| stats count | eval [| stats count | eval elvis=5 | return elvis]

[systemjack]

It works! And much prettier than the ugly kludges I was trying that didn't work. I added a trailing slash to the regex and changed "as max_count" to "as query".

The second one didn't work for me. Probably because I simplified the search I posted here. Bean_count is actually based off a multi-value field created by sistats. I could probably get it working but I still don't grok stats and mvfields.

Thank you so much 🙂