Splunk Search

continue search logic when first search returns 0 results

brdr
Contributor

Is there a way I can continue my search when first search returns 0 events. Returning 0 events is a valid scenario in my search. For example:

index=myindex1 
| stats count by requests
| where count > 1

If there are no results returned, then run another search.

index=myindex2
| table myfield1 myfield2

Thank you

Tags (1)
0 Karma

somesoni2
Revered Legend

Give this a try

index=myindex1 
 | stats count by requests
 | where count > 1
| appendpipe [| stats count | where count=0 
       | map search="search  index=myindex2
 | table myfield1 myfield2" ]
0 Karma

brdr
Contributor

cool. I will give this a try tomorrow. Will keep you posted and thanks for the quick response!

brdr

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...