Splunk Search

How can I edit my search so if my subsearch returns no results, my main search returns all events from index="test"?

rmuraly
Explorer
index="test"  [search index="test_summary" key_field="y" | head 1 | eval search = "_time>" . _time | fields search]
| table a,b,c

I have to return everything under "test" where _time>_time of y_summary. This search works fine as long as there is something under test_summary with key_field="y".

But, if there are no events returned by the sub search, my main search should return all the items in the index="test"

How do I get it working.. I have been on this for a day now.. with very little progress to show..

0 Karma
1 Solution

sundareshr
Legend

Try this

index="test" [search index="test_summary" key_field="y" | head 1 | eval earliest=_time | append [ | makeresults | eval earliest=0] | head 1 | return earliest ]

View solution in original post

0 Karma

MuS
Legend

Hi rmuraly,

You should avoid sub searches, because they are slow and will hit limits as soon as you put real data volumes through them. Try a simple conditional eval on this:

index="test" OR index="test_summary"
| eval y_time=if(index="test_summary" AND key_field="y", _time, 0)
| stats max(y_time) AS y_time max(_time) as _time by _time (add any other fields needed further down the pipe ...)
| where _time > y_time
| do more splunk-fu here ....

This may or may not provide a solution to you, but it for sure shows a way to go. You can read more on this topic in this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... or in the March session of the Virtual .conf here http://wiki.splunk.com/Virtual_.conf

Hope this helps ...

cheers, MuS

0 Karma

sundareshr
Legend

Try this

index="test" [search index="test_summary" key_field="y" | head 1 | eval earliest=_time | append [ | makeresults | eval earliest=0] | head 1 | return earliest ]
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...