Splunk Search

How can I abort a search when a subsearch returns zero results

Path Finder

I'm doing something like this:

[search host=*prod* source=*stats.log execTime > 10000 | fields msgID] | search host=*prod*

Which returns all my statistical and transactional records for msgIDs whose statistical record shows they took more than 10 seconds to complete. The problem is that when there are no results returned from the subsearch, the format passed to the parent search is "NOT()", which causes all records from the time period to be displayed. This is highly confusing to the user.

How can I abort the parent search and show no results when the subsearch returns nothing?


Tags (1)

Splunk Employee
Splunk Employee

It should not be the case that "NOT ()" matches everything. By convention, "()" is the same as "*" to Splunk (this is because the empty set of conjuncts should match everything). So "NOT ()" is the same as "NOT *" which should match nothing.

I verified this by the search:

[stats count | search count = 1] | stats count

This yields an empty subsearch which results in "NOT ()" and no results come out.

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST