Why are results showing when there are none?

[lostcauz3]

Hi,

I have an index= random_index which contains JSON data of a URL HTTP status code like {'availability':200,application:'random_name'}.
the above index gets  input  from an RPA bot through sent to the splunk http event collector endpoint every hour.

example search query 

index=random_index earliest=-24h latest=now
|  search availability=200
| lookup Application_details.csv application OUTPUT Service,ServiceOffering,AssignmentGroup,Priority

| stats count as avaibility_count

| eval availability_percentage=  (avaibility_count/24)*100
| search availability_percentage < 95
| table availability_percentage,Service, ServiceOffering,AssignmentGroup,Priority

| appendpipe[ 
| stats count 

| where count=0

| appendcols [| eval availability_percentage=0,Service=random_service,AssignmentGroup=random_group etc

| table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority

]]
| dedup availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority

| table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority

if the percentage is less than 95% then we will trigger an email and create a ServiceNow incident through the row that is returned in the Splunk search

but in case the index didn't receive the data per hour due to some error,

how to check that and still return a dummy result only if no results are returned

but not to return the dummy result in the append-pipe section  in the case where availability is less than 95%

[ITWhisperer]

You could try something like this

| appendpipe
    [| stats count
    | where count=0
    | eval availability_percentage=101]
| search availability_percentage < 95 OR availability_percentage > 100
| appendpipe
    [| stats count
    | where count = 0
    | eval eval availability_percentage=0,Service="random_service",ServiceOffering="random_offering", AssignmentGroup="random_group", Priority=1
    | table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority]

Note that your original appendpipe doesn't need to appendcols since, at this point, there are no events, so the eval of the dummy fields is sufficient.