Splunk Search

How to make use of makeresults statement based on conditions ?

nomadichunters
Explorer

If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition?

i.e How to make use of makeresults statement based on conditions ?

Kindly help

Tags (1)

harsmarvania57
Ultra Champion

Hi,

Do you really need to use makeresults ?

You can try something like this

| makeresults
| eval B_field=""
| append [ makeresults | eval B_field="Test"]
| eval result=if(isnull(B_field) OR B_field="","Dummy_Data",B_field)
0 Karma

nomadichunters
Explorer
index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* 
| eval 
    [ search index= app_core sourcetype= app_log apple_cluster_name= APP_TEST is_scheduled=1 eai_acl_owner=* 
    | eval 
        [ search index= app_core sourcetype= app_log is_scheduled=1 apple_cluster_name= APP_TEST eai_acl_owner=* 
        | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
        | stats count values(dataStatus) as dataStatus dc(anotherSavedSearchUseInSearch) as rexCount 
        | eval dataStatus = if(count == 0 ,"dataDoesntExist","dataExists") 
        | eval dataStatusAndRexStatus = dataStatus.",".rexCount 
        | return dataStatusAndRexStatus ] 
    | eval dataStatus = mvindex(split(dataStatusAndRexStatus,","),0) 
    | eval rexCount = mvindex(split(dataStatusAndRexStatus,","),1) 
    | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
    | eval anotherSavedSearchUseInSearch = case(dataStatus == "dataDoesntExist","NoTitle2", rexCount == 0,"NoTitle2",rexCount > 0,anotherSavedSearchUseInSearch) 
    | stats values(anotherSavedSearchUseInSearch) as Title2 delim=" " 
    | nomv Title2 
    | return Title2]

From subsearch ——> Title2 is returning some value.

But mainsearch (index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* ) —> This is common ,
1. doesnt have any data in it , then it is showing error : Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression.
2. if data exists , then it doesnt thrown any error.

The query should also work when data doesnt exists.

0 Karma

DMohn
Motivator

As stated in the other question (https://answers.splunk.com/answers/726353/subsearch-returns-empty-value-main-search-also-ret.html) you can use a eval Title2=coalesce(Title2,"") to ensure your subsearch returns a valid result.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...