Eval subsearch give error when result not found

[salt87]

Hi,

my search is the following

| inputlookup genesis.csv

| eval _time=now()
| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1| return $count]

| outputlookup blabla.csv

This works when the subsearch returns a value, however it gives me an error when the subsearch return "No Result Found"

Is there something I can do to replace the error by the value "0"

thanks

[MuS · Accepted solution]

Hi salt87,

give this a try:

| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1
| appendpipe 
    [| stats count 
    | where count=0]| return $count]

all this does is it will return something even you have no match. In the case of no match it will have count = 0 as result.

Hope this helps ...

cheers, MuS

[salt87]

You're a legend mate.