help with counting search events / output needed

[damucka]

Hello,

I need a help with counting the search results.
I cannot use the following:

| stats count as Total

because the stats command destroys my output that I got from the database. On the simple example:

| noop search_optimization=false| dbxquery query="
select now() from dummy
" connection="HANA_MLBSO"

| stats count as Total

I get only a Total under the Statistics tab as a result, otherwise the date coming from now().
My goal is to trigger the custom command at the end of search, but only then if the search returned any results, be it events or dbxquery output. Something like that:

index=mlbso sourcetype=isp_hanatraces secondary

| stats count as Total

| where Total > 0 

| eval SEVERITY = 3
| eval AlertSource = "SPLUNK"
| eval AlertText = "Test"
| eval  ShortText = "HANA crash" 
| eval SID = "SID"
| eval DB = "DBSID"
| eval host = host
| eval _time = "TIME"
| mycommand

So, for the example above it would maybe even work as there are events returned, but for the DB output of the dbxquery not.

Is there any elegant way to check if the result returned is not empty without deploying stats?

Kind REgards,
Kamil

[somesoni2]

Add below after your stats command.

| appendpipe [| stats count as Total| where Total=0 ]

[richgalloway · Accepted solution]

Try stats count as Total, values(*) as *.