Splunk Search

How to edit my eval syntax to check if the value "No results found." exists?

email2vamsi
Explorer
|eval final = if(running_ok==" " OR running_ok==1,1,0)

I want to assign final=1 when (running_ok=="No results found." OR running_ok==1).

Running_ok==1 works fine, but it does not work when running_ok=="No results found."
Please let me know what needs to be used on the RHS when search returns no values.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How about this?

|eval final = if(isnull(running_ok) OR running_ok==1,1,0)
---
If this reply helps you, Karma would be appreciated.
0 Karma

email2vamsi
Explorer
index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv 

I am using join on two sourcetypes for the field "running_ok".
The following table is derived based on how the inner join functions.

(Main search "running_ok" result),(Sub search "running_ok" result)= 0 or 1 or Blank(Join Search returned no values.)
0,0=0 (Running)
1,0= blank (Not Running)
0,1= blank (Not Running)
1,1=1 (Not Running)

|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok=="Join search returns no values." OR running_ok==1,1,0) 

From the above i am able to assign required value for "final" when running_ok=0 or 1.
But I could not assign value for "final" when "Join search returns no values."

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One has to force a search to return a response when there are no events that match. The appendpipe command is often used for that. Try this updated query.

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | appendpipe [ stats count | eval monitor_status="Not running" | where count==0 | fields - count ] | eval running_ok = if(monitor_status="Running","0","1")|head 1] 
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv
---
If this reply helps you, Karma would be appreciated.
0 Karma

sundareshr
Legend

Try this

.... | eval final=if(match(running_ok, "No results") OR running_ok=1, 1, 0) | ...
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...