Splunk Search

How to use eval if there is no result from the base search and without the use of any subsearch?

MuS
SplunkTrust
SplunkTrust

Hello everybody,

there were two questions lately, related to using eval when there were no events from the base search:

http://answers.splunk.com/answers/171101/stats-count-eval-error-using-or.html
http://answers.splunk.com/answers/174458/error-when-using-eval-in-a-range.html

So, how to use eval if there is no result from the base search and (as you already might have figured out) without the use of any subsearch ?

cheers, MuS

1 Solution

MuS
SplunkTrust
SplunkTrust

I will show an example using this run everywhere command and explain it line by line:

First is the base search:

index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h 

Next we do some eval to get some fake isFailure field:

| eval isFailure=if(searchmatch("source"),1,0)

Now comes the trick, do a simple stats count AS .. and provide any further needed values as well:

| stats count as myCount sum(isFailure) AS isFailure

Next, check if there were no search results, if so set the value of isFailure to "0" .If there were search results, set isFailureto the sum of the isFailure field:

| eval isFailure=if(myCount=="0",0,isFailure)

Now set the failuresCategory to different levels:

| eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe")

and finally display it using table

| table myCount, failuresCategory, isFailure

Now, let do the no results search and see if this works:

index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h this will bring back no results from the base search
| eval isFailure=if(searchmatch("source"),1,0)
| stats count as myCount sum(isFailure) AS isFailure
| eval isFailure=if(myCount=="0",0,isFailure)
| eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe")
| table myCount, failuresCategory, isFailure

and the result looks like this:
alt text

Instead of table you can use any command like chart or rangemap as well.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

I will show an example using this run everywhere command and explain it line by line:

First is the base search:

index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h 

Next we do some eval to get some fake isFailure field:

| eval isFailure=if(searchmatch("source"),1,0)

Now comes the trick, do a simple stats count AS .. and provide any further needed values as well:

| stats count as myCount sum(isFailure) AS isFailure

Next, check if there were no search results, if so set the value of isFailure to "0" .If there were search results, set isFailureto the sum of the isFailure field:

| eval isFailure=if(myCount=="0",0,isFailure)

Now set the failuresCategory to different levels:

| eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe")

and finally display it using table

| table myCount, failuresCategory, isFailure

Now, let do the no results search and see if this works:

index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h this will bring back no results from the base search
| eval isFailure=if(searchmatch("source"),1,0)
| stats count as myCount sum(isFailure) AS isFailure
| eval isFailure=if(myCount=="0",0,isFailure)
| eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe")
| table myCount, failuresCategory, isFailure

and the result looks like this:
alt text

Instead of table you can use any command like chart or rangemap as well.

hope this helps ...

cheers, MuS

rmarcum
Explorer

Very nice! Sooo, how would I do this with a "stats" command using "by _time". Ths solution is working perfectly on my implementations, but now I have one grouped by time. Maybe I need to run it through a timechart instead...hmmm

Thank you!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...