Hello,
I need a help with counting the search results.
I cannot use the following:
| stats count as Total
because the stats command destroys my output that I got from the database. On the simple example:
| noop search_optimization=false| dbxquery query="
select now() from dummy
" connection="HANA_MLBSO"
| stats count as Total
I get only a Total under the Statistics tab as a result, otherwise the date coming from now().
My goal is to trigger the custom command at the end of search, but only then if the search returned any results, be it events or dbxquery output. Something like that:
index=mlbso sourcetype=isp_hanatraces secondary
| stats count as Total
| where Total > 0
| eval SEVERITY = 3
| eval AlertSource = "SPLUNK"
| eval AlertText = "Test"
| eval ShortText = "HANA crash"
| eval SID = "SID"
| eval DB = "DBSID"
| eval host = host
| eval _time = "TIME"
| mycommand
So, for the example above it would maybe even work as there are events returned, but for the DB output of the dbxquery not.
Is there any elegant way to check if the result returned is not empty without deploying stats?
Kind REgards,
Kamil
Try stats count as Total, values(*) as *
.
Add below after your stats command.
| appendpipe [| stats count as Total| where Total=0 ]
Try stats count as Total, values(*) as *
.