Is there a way in splunk to have a table updated only when the query returns results. For Instance
if there 50 indexes and we have 50 separate saved searches scheduled to run at 1hr intervals
Index=index1 | stats count | eval status=if(count>100,1,0)
Index=index2 | stats count | eval status=if(count>100,1,0)
The table is to be updated only when status is 1. Like that keep appending the table the table when ever the status is one. Can this be accomplished ?
