Splunk Search

How can I abort a search when a subsearch returns zero results

pde
Path Finder

I'm doing something like this:

[search host=*prod* source=*stats.log execTime > 10000 | fields msgID] | search host=*prod*

Which returns all my statistical and transactional records for msgIDs whose statistical record shows they took more than 10 seconds to complete. The problem is that when there are no results returned from the subsearch, the format passed to the parent search is "NOT()", which causes all records from the time period to be displayed. This is highly confusing to the user.

How can I abort the parent search and show no results when the subsearch returns nothing?

Thanks

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

It should not be the case that "NOT ()" matches everything. By convention, "()" is the same as "*" to Splunk (this is because the empty set of conjuncts should match everything). So "NOT ()" is the same as "NOT *" which should match nothing.

I verified this by the search:

[stats count | search count = 1] | stats count

This yields an empty subsearch which results in "NOT ()" and no results come out.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...