All Apps and Add-ons

Using the Splunk Web Framework, how to check if a query produces results and if not, display "there are no results"?

Federica_92
Communicator

Hi everyone,

How can I check if one query in my home.html page, created using the splunk framework, has produced results or not?

I would like do something like:

  results_query=something
  If results_query>0
        print results
  else 
        print "there are no results"
0 Karma

markthompson
Builder

As this looks to be standard SQL, or SPL.

You should be able to use numrows or you could use stats count to define a field, and use an if on that field.

0 Karma

markthompson
Builder

Try this:

| stats count | eval msg="No logs!" | table msg

Credit to @hexx from his answer here;
http://answers.splunk.com/answers/50379/table-message-when-no-results-found.html

0 Karma

Federica_92
Communicator

Thank you for your reply, how can I use numrows to save the number of line and use the value for an if condition?

0 Karma

markthompson
Builder

Is this SQL, or SPL?

0 Karma

Federica_92
Communicator

SPL, yes in all in one html page

0 Karma

markthompson
Builder

and is this all part of one page? If so you can use the if statement inside an eval in your search

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...