Splunk Search

How to make use of makeresults statement based on conditions ?


If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition?

i.e How to make use of makeresults statement based on conditions ?

Kindly help

Tags (1)



Do you really need to use makeresults ?

You can try something like this

| makeresults
| eval B_field=""
| append [ makeresults | eval B_field="Test"]
| eval result=if(isnull(B_field) OR B_field="","Dummy_Data",B_field)
0 Karma

index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* 
| eval 
    [ search index= app_core sourcetype= app_log apple_cluster_name= APP_TEST is_scheduled=1 eai_acl_owner=* 
    | eval 
        [ search index= app_core sourcetype= app_log is_scheduled=1 apple_cluster_name= APP_TEST eai_acl_owner=* 
        | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
        | stats count values(dataStatus) as dataStatus dc(anotherSavedSearchUseInSearch) as rexCount 
        | eval dataStatus = if(count == 0 ,"dataDoesntExist","dataExists") 
        | eval dataStatusAndRexStatus = dataStatus.",".rexCount 
        | return dataStatusAndRexStatus ] 
    | eval dataStatus = mvindex(split(dataStatusAndRexStatus,","),0) 
    | eval rexCount = mvindex(split(dataStatusAndRexStatus,","),1) 
    | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
    | eval anotherSavedSearchUseInSearch = case(dataStatus == "dataDoesntExist","NoTitle2", rexCount == 0,"NoTitle2",rexCount > 0,anotherSavedSearchUseInSearch) 
    | stats values(anotherSavedSearchUseInSearch) as Title2 delim=" " 
    | nomv Title2 
    | return Title2]

From subsearch ——> Title2 is returning some value.

But mainsearch (index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* ) —> This is common ,
1. doesnt have any data in it , then it is showing error : Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression.
2. if data exists , then it doesnt thrown any error.

The query should also work when data doesnt exists.

0 Karma


As stated in the other question (https://answers.splunk.com/answers/726353/subsearch-returns-empty-value-main-search-also-ret.html) you can use a eval Title2=coalesce(Title2,"") to ensure your subsearch returns a valid result.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...