Exit during search?

[yuwtennis]

Hi!

Is it possible to exit during the search ?

For example,

search index=xxx [ search xxxxx format ]

If above sub search returns 0 events exit the search.

Thanks,
Yu

[martin_mueller]

You could hack your way into conditional execution with map:

some search that returns either one or zero results | map search="the other search"

map will run "the other search" for each event returned by "some search...", so if "some search..." returns one event it will run "the other search" once and if it returns zero events it will not run "the other search" at all.

[HiroshiSatoh]

This is a mistake?
search index=xxx [ search xxxxx format ]
search index=xxx [ search xxxxx |format ]