Splunk Search

Return message based on what is NOT showing in Subsearch

Explorer

I have a subsearch returning all files imported per client as the value "ClientFile". It's value will look like ABCFile1. Based on what is returned in this first search, I have second part of the search to look if files were missed, and if that value is not returned I want it to write a message to the table being returned. Below is the search I have so far but it is not returning the missed files correctly.


| append [ search source=importhelpers Moved earliest=-25h@h
| eval time=strftime(round(strptime(fileTime, "%I:%M:%S %P")), "%H:%M:%S")
| eval Client
File = ClientID + "" + FileImported ] | eval time=strftime(now(), "%H:%M:%S") | eval dow=strftime(strptime(fileDate, "%m/%d/%Y"), "%A")

| eval MissedFiles = case(ClientFile!="ABCFile1" AND time>"12:25:00" AND dow!="Sunday" AND dow!="Saturday", "ABC Missed File1 File. It was expected by 12:25:00",
ClientFile!="ABCFile2" AND time>"12:25:00" AND dow!="Sunday" AND dow!="Saturday", "ABC Missed File2 File. It was expected by 12:25:00",
ClientFile!="ABCFile3" AND time>"12:25:00" AND dow!="Sunday" AND dow!="Saturday", "ABC Missed File3 File. It was expected by 12:25:00")
| where isnotnull(MissedFiles)
| rename MissedFiles as "Missed Files Message Alert" | table "Missed Files Message Alert"

0 Karma