Splunk Search

Question on no data in index "no results found"

Builder

I have 2 situations to address..
1. if no data in index for timeframe , create a blank row with "no data" and come out of query
2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.

can both of these be achieved in a single query.
basically search index for data, if data not found, create "nodata" row, exit,
else if data found, but no results on eval, then create "0" row ...

hope i am clear with my question.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

There is no concept of "come out of query" in SPL. All queries run to the end.

To add "no data" to your query, use appendpipe near the end.

... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

There is no concept of "come out of query" in SPL. All queries run to the end.

To add "no data" to your query, use appendpipe near the end.

... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Builder

i saw the append pipe fix , but was wondering if anybody knew any other trick to get this working..
this fix helps me get things going...

i wish , if then else statements worked with spl the same way they work in other languages..

thanks..

0 Karma

SplunkTrust
SplunkTrust

Go to https://ideas.splunk.com to submit a feature request.

---
If this reply helps you, an upvote would be appreciated.
0 Karma