Splunk Search

How to make use of makeresults statement based on conditions ?


If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition?

i.e How to make use of makeresults statement based on conditions ?

Kindly help

Tags (1)



Do you really need to use makeresults ?

You can try something like this

| makeresults
| eval B_field=""
| append [ makeresults | eval B_field="Test"]
| eval result=if(isnull(B_field) OR B_field="","Dummy_Data",B_field)
0 Karma

index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* 
| eval 
    [ search index= app_core sourcetype= app_log apple_cluster_name= APP_TEST is_scheduled=1 eai_acl_owner=* 
    | eval 
        [ search index= app_core sourcetype= app_log is_scheduled=1 apple_cluster_name= APP_TEST eai_acl_owner=* 
        | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
        | stats count values(dataStatus) as dataStatus dc(anotherSavedSearchUseInSearch) as rexCount 
        | eval dataStatus = if(count == 0 ,"dataDoesntExist","dataExists") 
        | eval dataStatusAndRexStatus = dataStatus.",".rexCount 
        | return dataStatusAndRexStatus ] 
    | eval dataStatus = mvindex(split(dataStatusAndRexStatus,","),0) 
    | eval rexCount = mvindex(split(dataStatusAndRexStatus,","),1) 
    | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" 
    | eval anotherSavedSearchUseInSearch = case(dataStatus == "dataDoesntExist","NoTitle2", rexCount == 0,"NoTitle2",rexCount > 0,anotherSavedSearchUseInSearch) 
    | stats values(anotherSavedSearchUseInSearch) as Title2 delim=" " 
    | nomv Title2 
    | return Title2]

From subsearch ——> Title2 is returning some value.

But mainsearch (index=app_core sourcetype=app_log apple_cluster_name=APP_TEST is_scheduled=1 eai_acl_owner=* ) —> This is common ,
1. doesnt have any data in it , then it is showing error : Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression.
2. if data exists , then it doesnt thrown any error.

The query should also work when data doesnt exists.

0 Karma


As stated in the other question (https://answers.splunk.com/answers/726353/subsearch-returns-empty-value-main-search-also-ret.html) you can use a eval Title2=coalesce(Title2,"") to ensure your subsearch returns a valid result.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...