How to run the main search only if the subsearch returns true?

[prakashbhanu407]

I have to run the Main search only on the last working day of the month, and I got to a search that should work, but the main search is not taking the boolean response of subsearch as a condition to process the rest of the search.

Here is my search:

index=MyIndex queryType="ts" filename=Pharmacy*.JSON [| gentimes start=-1 | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) | eval query=if(relative_time(now(),"@d")=lastWDOM,1=1,1=2) | table query] | table _time,accountName,filename,filesize 

[somesoni2]

Try like this

index=MyIndex queryType="ts" filename=Pharmacy*.JSON [| gentimes start=-1 | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) | eval index=if(relative_time(now(),"@d")=lastWDOM,"MyIndex","YouWillNotFindThisIndex") | table index] | table _time,accountName,filename,filesize

Basically, if the subsearch condition is false, it'll return a value for field (metadata field used for better performance) index which may never exist so main search will not run. It returns the same index name as main search in case the condition is true.

[javiergn]

You can use map to simulate a conditional execution:

| gentimes start=-1
| eval lastDOM=relative_time(now(),"+1mon@mon-1d") 
| eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"), strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) 
| eval n_searches=if(relative_time(now(),"@d")=lastWDOM, 1, 0)
| where n_searches > 0
| map maxsearches=1 search="
    | search index=MyIndex queryType=\"ts\" filename=Pharmacy*.JSON 
    | table _time,accountName,filename,filesize
"

[ibob0304]

I couldn't thank much on using map, it solved my long standing issue.. thanks alot..

[woodcock]

You cannot assign boolean values to a field. Try this:

index=MyIndex queryType="ts" filename=Pharmacy*.JSON earliest=[| gentimes start=-1 | addinfo | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),true(),lastDOM) | eval earliest=if(relative_time(now(),"@d")=lastWDOM,"Do Not Run",info_min_time) | return $earliest] | table _time accountName filename filesize

This will cause the search to crash if it does not meet your criteria.