Splunk Search

How to run a search if another search does not return any results?

drautb
Explorer

Hey all,

I have two searches that both run independently of one another. They both work fine by themselves. Now, I would like the run the second search, if and only if, the first search does NOT return any results. I'm trying to do something like this right now:

<first search> | stats count | where count=0 | <second search>

But that doesn't quite work, the events from are returned, but no others are. What I'd like is for the events from to just be dropped, and the events from to be returned if there were NOT any results for . Has anyone done this before?

Tags (2)

the_wolverine
Champion

If you schedule the first search, you could schedule a second search which looks for result_count=0 in the internal log:

index=_internal startminutesago=5 sourcetype=scheduler savedsearch_name="name_of_first_scheduled_search" status=success result_count=0 | append [ search "second search query" ]

drautb
Explorer

I apologize, thanks for catching that. I've edited my question.

0 Karma

strive
Influencer

What if there are no results from first search? In that case you want your second search to be executed or not executed?

You have contradicting statements in your question.

"Now, I would like the run the second search, if and only if, the first search doesn't return any results."

"What I'd like is for the events from to just be dropped, and the events from to be returned if there were any results for "

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...