Splunk Search

Question on no data in index "no results found"

jiaqya
Builder

I have 2 situations to address..
1. if no data in index for timeframe , create a blank row with "no data" and come out of query
2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.

can both of these be achieved in a single query.
basically search index for data, if data not found, create "nodata" row, exit,
else if data found, but no results on eval, then create "0" row ...

hope i am clear with my question.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no concept of "come out of query" in SPL. All queries run to the end.

To add "no data" to your query, use appendpipe near the end.

... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no concept of "come out of query" in SPL. All queries run to the end.

To add "no data" to your query, use appendpipe near the end.

... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
---
If this reply helps you, Karma would be appreciated.
0 Karma

jiaqya
Builder

i saw the append pipe fix , but was wondering if anybody knew any other trick to get this working..
this fix helps me get things going...

i wish , if then else statements worked with spl the same way they work in other languages..

thanks..

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Go to https://ideas.splunk.com to submit a feature request.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...