subsearch returning an empty set causes unexpected results

[timpgray]

I am using a subsearch to qualify an outer search. Simplified, it looks something like this:

Index =AAAA [index=AAAA “some condition” | dedup BBBB | return 100 BBBB]

The intent is to use the returned values of the field ‘BBBB’ to qualify the outer search and this works as expected. However, there is a corner case where this fails badly. When the value ‘some condition’ does not show up in the searched data, the subsearch returns an empty set and the outer search is then left wide open producing some unexpected results.

Does anyone have any suggestion how I might construct the subsearch to return NOT() in the scenario that the inner condition is not met?

[Ayn · Accepted solution]

This is what the subsearch already normally does when no results are found. Using return at the end causes a different behaviour though. Rewriting the query not to use return should fix it.

index=AAAA [search index=AAAA "some condition" | dedup BBBB | head 100 | fields BBBB]

[Ayn]

No problem - if you want to see for yourself exactly what the subsearch will return, just run the search by itself and add "| format" at the end.

[timpgray]

thanks - that helps a lot.