Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

conditional search

$
0
0
I've read other answers related to conditional searches, still cannot find an answer to my problem. The situation is following. I have one search (S1, runs on index1) which provides values to search for another search (S2, runs on index2). Something like index=index2 [ search index1 | stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip Usually S1 has non-empty results. In most cases S2 doesn't have any results and I'm interested in cases when there are results from S2. In that case I'd like to append results from S1. So my final query basically has such a structure: index=index2 [ search index1 | stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip | append [ search index1 | stats count by src_ip | where count > N | fields src_ip ] The problem is that as I've mentioned, S1 query has results most of the time, therefore append (and my final query) has too. I'd like to run append only when there are non empty results from the first part.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>