Splunk Search

Empty result subsearch in eval/case

csocha
New Member

I am trying to eval a new field based on matching several sub searches. The issue is that these sub searches can potentially return an empty result which breaks the syntax of the eval command. Example:

index=A loglevel=error 
| eval group=case(
[search  "search string 1" | fields correlationField], "group 1",   
[search  "search string 2" | fields correlationField], "group 2"
1=1, "other")

In this example if "search string 1" is not found in the time range then an empty result is used for the condition for group 1, which causes an error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you're just setting group value based on which search string returns results (and not passing the actual value from subsearch), you can try like this

index=A loglevel=error 
 | eval group=case(
 [search  "search string 1" | stats count as search ]>0, "group 1",   
 [search  "search string 2" | stats count as search]>0, "group 2",
 1=1, "other")

You can also try this

index=A loglevel=error
| appendcols [search  "search string 1" | stats count by correlationField | table correlationField | rename correlationField as group1]
| appendcols [search  "search string 2" | stats count by correlationField | table correlationField | rename correlationField as group1]
| eval group=case(isnotnull(group1),"group1", isnotnull(group2),"group2", 1=1,"other")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You'll need to add to your subsearch so there's always a correlationField. Maybe this will help.

index=A loglevel=error 
| eval group=case(
[search  "search string 1" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 1",   
[search  "search string 2" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 2"
1=1, "other")
---
If this reply helps you, Karma would be appreciated.
0 Karma

csocha
New Member

This has the same problem. The issue isn't results without a correlationField, it's that the subsearch might return no results at all.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...