How to handle no results from sub-search when using 'format' or 'return'

[jonfrancais]

We would like to use a sub-search to query an input and re-write the search query to alter the search used in the main search. The input may sometimes contain no data.

The input data contains a list of KEY/VALUE fields. We would like the resultant query returned from the sub-search to be:

(ID1=<KEY> OR ID2=<KEY>) AND ID3=<VALUE>

For the purposes of this question, we can use an inputlookup sub-search as an example. The following works when the input contains data. We use 'return $search' to ensure the query returned is not surrounded by double-quotes (which 'format' would do).

[| inputlookup myfile | eval search="((ID1=".KEY." OR ID2=".KEY.") AND ID3=".VALUE.")" | return $search]

However, when there is no data returned from the inputlookup and the 'return' command returns nothing, e.g '', it creates a main search which looks for everything. If 'format' is used instead, then 'NOT()' is returned correctly, but then when there are results, the search query string is returned with the double-quotes.

How should the query be returned from a sub-search to ensure that 'NOT ()' is returned when there are no results and also that the search string is returned without quotes when there are?

[gfuente]

Hello

Have you tried to include the NOT into the subsearch, so if there are values it will be included, and if there is no results the subsearch will no return anything at all, and the query will execute. Modify your eval this way

eval search=" NOT ((ID1=".KEY." OR ID2=".KEY.") AND ID3=".VALUE.")"

Try it and let me know if it works.

Regards