Splunk Search

How can I abort a search when a subsearch returns zero results

pde
Path Finder

I'm doing something like this:

[search host=*prod* source=*stats.log execTime > 10000 | fields msgID] | search host=*prod*

Which returns all my statistical and transactional records for msgIDs whose statistical record shows they took more than 10 seconds to complete. The problem is that when there are no results returned from the subsearch, the format passed to the parent search is "NOT()", which causes all records from the time period to be displayed. This is highly confusing to the user.

How can I abort the parent search and show no results when the subsearch returns nothing?

Thanks

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

It should not be the case that "NOT ()" matches everything. By convention, "()" is the same as "*" to Splunk (this is because the empty set of conjuncts should match everything). So "NOT ()" is the same as "NOT *" which should match nothing.

I verified this by the search:

[stats count | search count = 1] | stats count

This yields an empty subsearch which results in "NOT ()" and no results come out.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...