Splunk Search

continue search logic when first search returns 0 results

brdr
Contributor

Is there a way I can continue my search when first search returns 0 events. Returning 0 events is a valid scenario in my search. For example:

index=myindex1 
| stats count by requests
| where count > 1

If there are no results returned, then run another search.

index=myindex2
| table myfield1 myfield2

Thank you

Tags (1)
0 Karma

somesoni2
Revered Legend

Give this a try

index=myindex1 
 | stats count by requests
 | where count > 1
| appendpipe [| stats count | where count=0 
       | map search="search  index=myindex2
 | table myfield1 myfield2" ]
0 Karma

brdr
Contributor

cool. I will give this a try tomorrow. Will keep you posted and thanks for the quick response!

brdr

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...