Splunk Search

Searcing with empty index

omend
Path Finder

Hi all,

I have a Splunk index with records of the following format:

  • recordIndex - an integer key I automatically assign to this record upon insert
  • recordName - name of the record
  • recordComment - comment

(I temporarily use the recordIndex because both other fields consist of wildcards and it allows me to edit/delete them more easily. Later on, this index will be transfered to relational DB).

When I want to add a record to this index, I look for the largest recordIndex exists, add 1 to it, and use it for the new record. I use the following (simplified) search code:

index=myindex | sort -num(recordIndex) | head 1 | eval recordIndex=recordIndex+1 | eval recordName="$args.recordName$" | eval recordComment="$args.comment$" | table recordIndex recordName recordComment | collect index=index=myindex

However, there is a corner case where the index is empty. For this case only, I could use the following search:
index=_internal | head 1 | eval recordIndex=1 | eval recordName="$args.recordName$" | eval recordComment="$args.comment$" | table recordIndex recordName recordComment | collect index=index=myindex

My question is how to "combine" these 2 searches so they could work together in all cases.

Thanks,
Ori.

0 Karma
1 Solution

omend
Path Finder

I solved this by using the append function:

index=myindex | table recordIndex | sort -num(recordIndex) | head 1 | append [search index=_internal | head 1] | eval recordIndex=if(recordIndex>0,recordIndex+1,1) | eval recordName="$args.recordName$" | eval recordComment="$args.comment$" | table recordIndex recordName recordComment | sort -recordIndex | head 1 | collect index=myindex

View solution in original post

0 Karma

omend
Path Finder

I solved this by using the append function:

index=myindex | table recordIndex | sort -num(recordIndex) | head 1 | append [search index=_internal | head 1] | eval recordIndex=if(recordIndex>0,recordIndex+1,1) | eval recordName="$args.recordName$" | eval recordComment="$args.comment$" | table recordIndex recordName recordComment | sort -recordIndex | head 1 | collect index=myindex

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...