Splunk Search

Eval subsearch give error when result not found

salt87
Engager

Hi,

my search is the following

| inputlookup genesis.csv

| eval _time=now()
| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1| return $count]

| outputlookup blabla.csv

This works when the subsearch returns a value, however it gives me an error when the subsearch return "No Result Found"

Is there something I can do to replace the error by the value "0"

thanks

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi salt87,

give this a try:

| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1
| appendpipe 
    [| stats count 
    | where count=0]| return $count]

all this does is it will return something even you have no match. In the case of no match it will have count = 0 as result.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi salt87,

give this a try:

| eval field1=[ | inputlookup lookup.csv
| search Field1=value
| stats count by Field1
| appendpipe 
    [| stats count 
    | where count=0]| return $count]

all this does is it will return something even you have no match. In the case of no match it will have count = 0 as result.

Hope this helps ...

cheers, MuS

salt87
Engager

You're a legend mate.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...