Splunk Search

Search returns "No results found", when it should be returning 1.

Path Finder

The search below looks for an event for a specific client during a specific time. If the event is not there, I would want to be notified, thus a "1" should be returned.

There is no event, so noNull is 0. The case statement "end" should be "1-0" (1-noNull), so 1 should be returned. However, I get "No results found." FYI: the search does work is noNull is 1.

source=*D:\\FHSO\\imports* source=*daily\\imports* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| where ClientID="WHI"
| where ((like(source,"%"."WHI"."%")) AND time>"02:00:00" AND time<"02:25:00")
| stats count as lateEnds 
| eval noNull = if(ISNULL(lateEnds),0,lateEnds)
| eval end = case(ClientID="WHI", 1-noNull ) | table end
0 Karma


Hi griffinpair,
try something like this

source="*D:\FHSO\imports*" source="*daily\imports*" End earliest=-30h@h ClientID="WHI"
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| eval isEvent=if(like(source,"%"."WHI"."%") AND time>"02:00:00" AND time<"02:25:00",1,0)
| stats count as myCount sum(isEvent) AS isEvent
| eval noNull=if(isEvent>0, isEvent, myCount)
| eval end = case(ClientID="WHI","1-"+noNull)
| table end

The main search is strange because you used two conditions for source connected by AND clause: running only the main search have you results?.

P.S.: add always index in your search, is quicker!

0 Karma


A couple of things:

  1. Line 5 will return a zero if there are no results, so line six isn't necessary.
  2. Line 7 will never return anything because it is a case statement which requires a ClientID field that equals "WHI". The stats command in line 5 got rid of that field. To get that to evaluate the way you want, change line 7 to | eval end = 1 - lateEnds
0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...