Splunk Search

Query should return last/latest available data when there is no data for the selected time range

saichandjawari
Explorer

Query should return last/latest available data when there is no data for the selected time range

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, data is returned from the selected time range, if there is no data, what time range do you want to use?

You could do something like this

 

<your search>
| appendpipe
  [| stats count as _count
   | where _count = 0
   | where isnull(_count)
   | append
     [| search <your index> [| metasearch index=<your index> earliest=0
                             | head 1
                             | rename _time as earliest
                             | fields earliest]
      ]
   ]

 

0 Karma

saichandjawari
Explorer

The query is used in a dashboard panel as a statistical table with single row.  the data is usually  not available on regular intervals. Hence we would like to show the last available data instead of “no results found” when there is no data for the selected default time range that we have set.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK, so have you tried what I suggested?

0 Karma

saichandjawari
Explorer

Thanks for your response.

0 Karma

saichandjawari
Explorer

Yes, but that isn’t working. 

So here is a solution that I came up with — 


Step 1 - first write your results to a lookup file. 

<your query> |outputlookup yourlookup.csv

 

Step 2 - use that lookup in the query as shown below:

 

<your query> |append [|inputlookup yourlookup.csv 

|outputlookup yourlookup.csv override_if_empty = false create_empty = false]

 

the above query writes the results and stores in yourlookup.csv with wider time range. And  we are rewriting the stored results to the same lookupfile. In the last line override and Create_empty commands will make sure it will not give empty results. 
Note: use |dedup in the last if you see any duplicate results.

step 3- Create a saved search with this query and schedule it according to your requirement. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...