Is there a way I can continue my search when first search returns 0 events. Returning 0 events is a valid scenario in my search. For example:
index=myindex1
| stats count by requests
| where count > 1
If there are no results returned, then run another search.
index=myindex2
| table myfield1 myfield2
Thank you
Give this a try
index=myindex1
| stats count by requests
| where count > 1
| appendpipe [| stats count | where count=0
| map search="search index=myindex2
| table myfield1 myfield2" ]
cool. I will give this a try tomorrow. Will keep you posted and thanks for the quick response!
brdr