If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition? i.e How to make use of makeresults statement based on conditions ? Kindly help ... View more

index=app_core sourcetype=app_log cluster_name=app1_cluster is_scheduled=1 | eval [ search index=app_core sourcetype=app_log cluster_name=app1_cluster is_scheduled=1 | eval [ search index=app_core sourcetype=app_log cluster_name=app1_cluster is_scheduled=1 | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" | stats count values(dataStatus) as dataStatus dc(anotherSavedSearchUseInSearch) as rexCount | eval dataStatus = if(count == 0 ,"dataDoesntExist","dataExists") | eval dataStatusAndRexStatus = dataStatus.",".rexCount | return dataStatusAndRexStatus ] | eval dataStatus = mvindex(split(dataStatusAndRexStatus,","),0) | eval rexCount = mvindex(split(dataStatusAndRexStatus,","),1) | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?<anotherSavedSearchUseInSearch>(\w+){0,})" | eval anotherSavedSearchUseInSearch = case(dataStatus == "dataDoesntExist","NoTitle2", rexCount == 0,"NoTitle2",rexCount > 0,anotherSavedSearchUseInSearch) | stats values(anotherSavedSearchUseInSearch) as Title2 delim=" " | nomv Title2 | return Title2] If Title2 returns a value , then it doesnt throw any error. If Title2 is empty then it throws "Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression." Kindly help. ... View more

Query: index=data_core sourcetype=data_log is_scheduled=1 | rex max_match=0 field=search "savedsearch\s{0,}\"{1}(?(\w+){0,})" | eval anotherSavedSearchUseInSearch = if(isnull(anotherSavedSearchUseInSearch),"anotherSavedSearchNotUsedinSearch",anotherSavedSearchUseInSearch) | eval type1 = if((anotherSavedSearchUseInSearch != "anotherSavedSearchNotUsedinSearch"),"Title2",null()) | stats values(anotherSavedSearchUseInSearch) as Title2 values(type1) as type1 by title | sort title | join type=outer title [ search index=data_core sourcetype=data_log is_scheduled=1 ] | rename title as Title1 | rex max_match=0 field=search "index\s{0,}=\s{0,}\"{0,}\${0,}(?\*{0,}\w*\*{0,})" | eval indexusedinquery = if(isnull(indexusedinquery),0,1) | eval type2 = "Title1" | dedup Title1 Title2 | eval type = type1.",".type2 | where Title1 = "SB_EnrollmentInfo" OR Title1 = "RIO_RTL_SB_MDM_ENROLLMENT_INFO" OR Title1 = "Events_recevied_for_missing_index" OR Title1 = "ASTMS_CORP_SB_MDM_DEVICE_INFO" | fields Title1 Title2 indexusedinquery type Current Data Looks Like : Title1 Title2 indexusedinquery type Events_recevied_for_missing_index anotherSavedSearchNotUsedinSearch 0 null RIO_RTL_SB_MDM_ENROLLMENT_INFO SB_EnrollmentInfo 0 Title2,Title1 SB_EnrollmentInfo anotherSavedSearchNotUsedinSearch 1 null ASTMS_CORP_SB_MDM_DEVICE_INFO SB_EnrollmentInfo 1 Title2,Title1 Now my requirement is for each of value in field Title2 , should check for every other value in field Title1 until the first match of value is found. e.g. : Second Row Value in Title2 ( i.e . SB_EnrollmentInfo ) should check for the existence of the same value in Title1 , i.e. it should iterate up to row 3 , and stop there since the value matched and return me the indexusedinquery field value as 1 instead of 0 and the Total value should be summed up in indexusedinquery field (0 + 1) displayed as 1`. output should look like : Title1 Title2 indexusedinquery Events_recevied_for_missing_index anotherSavedSearchNotUsedinSearch 0 RIO_RTL_SB_MDM_ENROLLMENT_INFO SB_EnrollmentInfo 1 SB_EnrollmentInfo anotherSavedSearchNotUsedinSearch 1 ASTMS_CORP_SB_MDM_DEVICE_INFO SB_EnrollmentInfo 2 ... View more

Sample Events Looks like : {"title": "SavedSearch1", "action_email": "0", "action_summary_index": "0", "alert_expires": "2m", "author": "admin", "disabled": "0", "orphan": "0", "dispatch_earliest_time": "-60m@m", "dispatch_latest_time": "now", "eai_acl_app": "search", "eai_acl_owner": "admin", "eai_acl_sharing": "user", "is_scheduled": "0", "search": "| savedsearch “SavedSearch2” | search index=_audit | head 10", "cluster_name": "BIG_DATA"} {"title": "Savedsearch2", "action_email": "0", "action_summary_index": "0", "alert_expires": "2m", "author": "admin", "disabled": "0", "orphan": "0", "dispatch_earliest_time": "-60m@m", "dispatch_latest_time": "now", "eai_acl_app": "search", "eai_acl_owner": "admin", "eai_acl_sharing": "user", "is_scheduled": "0", "search": "| savedsearch “index=* | head 100", "cluster_name": "BIG_DATA"} I have to read the saved search list from my internal logs, check the existance and extract a particular field count and value from it . If the saved search is using another saved search inside the main saved search , then i have to again check the existance and extract the same particular field count and value from it, then join both of them and get the final count and values of that particular field. Eg : Consider Index as one field, i would have mutliple fields to be calculated in the same process. SavedSearch1 | savedsearch “SavedSearch2” | search index=_audit | head 10 Savedsearch2 index=* | head 100 index=application_core sourcetype=application_log | eval [ search index= application_core sourcetype= application_log | eval anotherSavedSearchUseInSearch="SavedSearch2" | where title=anotherSavedSearchUseInSearch | rex max_match=0 field=search "index\s{0,}=\s{0,}\"{0,}\${0,}(? *{0,}\w**{0,})" | eval indexusedinquery = if(isnull(indexusedinquery),"indexNotUsed",indexusedinquery) | table title indexusedinquery | fields title indexusedinquery | eval valuesReturnedfromsecondsearch = title.",".indexusedinquery | return valuesReturnedfromsecondsearch] output : FieldName : valuesReturnedfromsecondsearch FieldValue : Savedsearch2,* I am able to return the output if I manually pass the value SavedSearch2, but when i try to extract from rex and send , then the above query is not working. It is changing the title value from SavedSearch1 to SavedSearch2 simply ,but it has to then check for the events which has the anotherSavedSearchUseInSearch value as title, without changing the existing titlename. And This sub search should iterate for all the cases. ... View more

first query output : CommonField , FirstQueryValue1 , FirstQueryValue2 1 fv1 fv2_1 2 fv1 fv2_2 3 fv1 fv2_3 second query output : CommonField , SecondQueryValue1 , SecondQueryValue2 3 sv2 sv2_1 4 sv2 sv2_2 5 sv2 sv2_3 I want the ouptut in the below format CommonField, FirstQueryValue1, FirstQueryValue2, SecondQueryValue1, SecondQueryValue2 1 fv1 fv2_1 0 0 2 fv1 fv2_2 0 0 3 fv1 fv2_3 sv2 sv2_1 4 0 0 sv2 sv2_2 5 0 0 sv2 sv2_3 How to get the colums attached of first search and second results based on a common fieldvalue? ... View more