About jonfrancais

gfuente · ‎08-25-2016

Hello Have you tried to include the NOT into the subsearch, so if there are values it will be included, and if there is no results the subsearch will no return anything at all, and the query will execute. Modify your eval this way eval search=" NOT ((ID1=".KEY." OR ID2=".KEY.") AND ID3=".VALUE.")" Try it and let me know if it works. Regards

svasavada_splun · ‎11-09-2019

This was really helpful, thanks a lot for that! Can you please tell me how can I do it using Splunklib (SCP version 2) Thanks again for your help!

kartik13 · ‎09-22-2015

any lead on this.Even i am trying to do the same thing .Any idea how to proceed.

Posts	5
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎02-16-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to handle no results from sub-search when usin...

Generating custom command with complete JSON field...

How to use Splunk's REST API or JavaScript SDK to ...

Re: How to handle no results from sub-search when ...

Re: Generating custom command with complete JSON f...

Re: How to use Splunk's REST API or JavaScript SDK...