conditional search

[mmasalas]

I've read other answers related to conditional searches, still cannot find an answer to my problem. The situation is following. I have one search (S1, runs on index1) which provides values to search for another search (S2, runs on index2). Something like

index=index2 [ search index1 |  stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip

Usually S1 has non-empty results. In most cases S2 doesn't have any results and I'm interested in cases when there are results from S2. In that case I'd like to append results from S1. So my final query basically has such a structure:

index=index2 [ search index1 |  stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip 
| append [ search index1 |  stats count by src_ip | where count > N | fields src_ip ]

The problem is that as I've mentioned, S1 query has results most of the time, therefore append (and my final query) has too. I'd like to run append only when there are non empty results from the first part.

[gcusello]

Hi @mmasalas,
at first, check the number of results of your subsearches because there's the limit of 50,000 results for subsearches.
Then you could try something like this

index=index1 OR index=index2
| stats values(dest_ip) AS dest_ip values(index) AS index dc(index) AS dc_index BY src_ip
| eval status=if(dc_index=1,index,"Both")
| mvexpand dest_ip
| stats values(status) AS status count BY src_ip dest_ip

Ciao.
Giuseppe