|eval final = if(running_ok==" " OR running_ok==1,1,0)
I want to assign final=1 when (running_ok=="No results found." OR running_ok==1).
Running_ok==1 works fine, but it does not work when running_ok=="No results found."
Please let me know what needs to be used on the RHS when search returns no values.
How about this?
|eval final = if(isnull(running_ok) OR running_ok==1,1,0)
index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | eval running_ok = if(monitor_status="Running","0","1")|head 1]
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv
I am using join on two sourcetypes for the field "running_ok".
The following table is derived based on how the inner join functions.
(Main search "running_ok" result),(Sub search "running_ok" result)= 0 or 1 or Blank(Join Search returned no values.)
0,0=0 (Running)
1,0= blank (Not Running)
0,1= blank (Not Running)
1,1=1 (Not Running)
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok=="Join search returns no values." OR running_ok==1,1,0)
From the above i am able to assign required value for "final" when running_ok=0 or 1.
But I could not assign value for "final" when "Join search returns no values."
One has to force a search to return a response when there are no events that match. The appendpipe command is often used for that. Try this updated query.
index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1
|join running_ok
[search index="Index1" sourcetype="monitor" | appendpipe [ stats count | eval monitor_status="Not running" | where count==0 | fields - count ] | eval running_ok = if(monitor_status="Running","0","1")|head 1]
|eval final = if(running_ok==0,0,1)
|eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv
Try this
.... | eval final=if(match(running_ok, "No results") OR running_ok=1, 1, 0) | ...