How to implement a Splunk query that is based on if the other Splunk query result exist or not

[winstonwcheney]

Hello, 

I am trying to develop a splunk query.  But the query that needs to be run is based on another SPlunk query return empty result. 

what command I can use? 

thank you

[winstonwcheney]

Thank you.  But this method seems not working, even my second search count =1, the first search still return result. 

[winstonwcheney]

Thank you, this method seems not working. Although second search count =1, it still get result for first search.

[ITWhisperer]

Which order have you put the searches - the first search should be the one which you are checking for zero results, the second search is the one you run if there are no results from the first search

[winstonwcheney]

Yes. But the result always return result for first search. 

[ITWhisperer]

So the first search returns a result, which according to your requirement means the second search should not run, which it doesn't. Isn't this what you asked for?

[winstonwcheney]

I mean, even first search return 0 result, the second still does not return expected result. 

[winstonwcheney]

The requirement is to see result of second query result. If first search result count = 1, we don't want to see any result. If first search result count =0, we want to see second search result but not first search result.

[winstonwcheney]

And even first search return count =0, second search also return empty result. I want second search return information as expected

[ITWhisperer]

Can you share your search to see if something else is going on to explain this behaviour?

[ITWhisperer]

You might be able to use appendpipe.

first search ...
| appendpipe
  [| stats count
   | where count=0
   | second search]