Hello Community, I have quite a strange issue to face... For a project I'm working on, I would need to create a new case if the search returns no events. I've tried to create a dummy example to make myself clear: | makeresults | eval letter1="A", letter2="B", letter3="C" | append     [| makeresults     | eval letter1="D", letter2="E", letter3="F"] | search letter1="K" | appendpipe     [| ??ifnotresults??     | append         [| makeresults         | eval letter1="X", letter2="Y", letter3="Z"]     | where false() ] | table letter1 letter2 letter3   In particular, I have no idea how to evaluate the ??ifnotresults??  part. Do you think it is possible to achieve this? Thanks in advance for your kind support ... View more

Hello community, on my desk, I have a pretty edgy request that is giving me quite a headache. I would need to collect (with | collect) the output of a search in a new sourcetype created dynamically within the search itself. Here you can find a simple ad hoc example: | makeresults | eval letter1="A", letter2="B", letter3="C" | eval variabile="NewSourcetype" | eval _raw=_time + ": " + _raw | collect index=garbage sourcetype=variabile Problem is that the event is stored under  sourcetype=variabile instead of sourcetype=NewSourcetype. Any idea how to manage such a situation? Thanks in advance for your kind support. ... View more

Hello Splunkers, for a project I'm working on, I would need to store different IDs in a variable after evaluating them with if or case. The idea is to check several conditions and if one or more are met, update the value of the variable. Example: event1: A | B | C  event2: A | C | E event3: B | F | G Conditions: if A is present  -> ID01 if B is present  -> ID02 if B is present  -> ID03 Result: event1: ID01,ID02,ID03 event2: ID01,ID03 event3: ID02 I tried to concatenate the results but with no success: | makeresults | eval letter1="A", letter2="B", letter3="C" | append [| makeresults | eval letter1="A", letter2="C", letter3="E"] | append [| makeresults | eval letter1="B", letter2="F", letter3="G"] | eval ID="" | eval ID=ID.if(letter1="A" OR letter2="A" OR letter3="A","ID01",NULL) | eval ID=ID.if(letter1="B" OR letter2="B" OR letter3="B",",ID02",NULL) | eval ID=ID.if(letter1="C" OR letter2="C" OR letter3="C",",ID02",NULL) |table letter1 letter2 letter3 ID ... View more