How to edit my eval syntax to check if the value "No results found." exists?

[email2vamsi]

|eval final = if(running_ok==" " OR running_ok==1,1,0)

I want to assign final=1 when (running_ok=="No results found." OR running_ok==1).

Running_ok==1 works fine, but it does not work when running_ok=="No results found."
Please let me know what needs to be used on the RHS when search returns no values.

[richgalloway]

How about this?

|eval final = if(isnull(running_ok) OR running_ok==1,1,0)

[email2vamsi]

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv 

I am using join on two sourcetypes for the field "running_ok".
The following table is derived based on how the inner join functions.

(Main search "running_ok" result),(Sub search "running_ok" result)= 0 or 1 or Blank(Join Search returned no values.)
0,0=0 (Running)
1,0= blank (Not Running)
0,1= blank (Not Running)
1,1=1 (Not Running)

|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok=="Join search returns no values." OR running_ok==1,1,0) 

From the above i am able to assign required value for "final" when running_ok=0 or 1.
But I could not assign value for "final" when "Join search returns no values."

[richgalloway]

One has to force a search to return a response when there are no events that match. The appendpipe command is often used for that. Try this updated query.

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | appendpipe [ stats count | eval monitor_status="Not running" | where count==0 | fields - count ] | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv

[sundareshr]

Try this

.... | eval final=if(match(running_ok, "No results") OR running_ok=1, 1, 0) | ...