Splunk Search

How to handle sub-search with no results and error in search command: "Unable to parse the search"?

amerineni
Loves-to-Learn

Why am I not getting results from this search?
Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side

| search c_ip=[search  | stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return $c_ip ]

Thanks

Tags (3)
0 Karma
1 Solution

PavelP
Motivator

Hello @amerineni

please try with | return c_ip ] , without $

| search [stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return c_ip ]

View solution in original post

0 Karma

PavelP
Motivator

Hello @amerineni

please try with | return c_ip ] , without $

| search [stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return c_ip ]
0 Karma

amerineni
Loves-to-Learn

I need to return some dummy data if my sub search returns no results, otherwise my main search is returning all results. I achieved by doing this. is there any better way to do this?

Anyway thanks for the response.

|
eval sub_uuid=[ search index=cloudfoundry cf_org_name=Magenta_Pay cf_app_name=PaymentRestApi-* "Result based on transactionID" $identifier$
| rex "(?ms)uuid=(?[^]]+)" | eval uuid=uuid
| return $uuid | format] |eval test=if(isNotNull(sub_uuid), sub_uuid, "XXXXX") | where uuid=sub_uuid | table URI, HttpStatus, ElapsedTime, _time

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...