I have 2 situations to address..
1. if no data in index for timeframe , create a blank row with "no data" and come out of query
2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.
can both of these be achieved in a single query.
basically search index for data, if data not found, create "nodata" row, exit,
else if data found, but no results on eval, then create "0" row ...
hope i am clear with my question.
There is no concept of "come out of query" in SPL. All queries run to the end.
To add "no data" to your query, use appendpipe
near the end.
... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
There is no concept of "come out of query" in SPL. All queries run to the end.
To add "no data" to your query, use appendpipe
near the end.
... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
i saw the append pipe fix , but was wondering if anybody knew any other trick to get this working..
this fix helps me get things going...
i wish , if then else statements worked with spl the same way they work in other languages..
thanks..
Go to https://ideas.splunk.com to submit a feature request.