Splunk Search

help with counting search events / output needed

damucka
Builder

Hello,

I need a help with counting the search results.
I cannot use the following:

| stats count as Total

because the stats command destroys my output that I got from the database. On the simple example:

| noop search_optimization=false| dbxquery query="
select now() from dummy
" connection="HANA_MLBSO"

| stats count as Total

I get only a Total under the Statistics tab as a result, otherwise the date coming from now().
My goal is to trigger the custom command at the end of search, but only then if the search returned any results, be it events or dbxquery output. Something like that:

index=mlbso sourcetype=isp_hanatraces secondary

| stats count as Total

| where Total > 0 

| eval SEVERITY = 3
| eval AlertSource = "SPLUNK"
| eval AlertText = "Test"
| eval  ShortText = "HANA crash" 
| eval SID = "SID"
| eval DB = "DBSID"
| eval host = host
| eval _time = "TIME"
| mycommand

So, for the example above it would maybe even work as there are events returned, but for the DB output of the dbxquery not.

Is there any elegant way to check if the result returned is not empty without deploying stats?

Kind REgards,
Kamil

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try stats count as Total, values(*) as *.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

somesoni2
Revered Legend

Add below after your stats command.

| appendpipe [| stats count as Total| where Total=0 ]
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try stats count as Total, values(*) as *.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...