Hi,
I have an index= random_index which contains JSON data of a URL HTTP status code like {'availability':200,application:'random_name'}.
the above index gets input from an RPA bot through sent to the splunk http event collector endpoint every hour.
example search query
index=random_index earliest=-24h latest=now
| search availability=200
| lookup Application_details.csv application OUTPUT Service,ServiceOffering,AssignmentGroup,Priority
| stats count as avaibility_count
| eval availability_percentage= (avaibility_count/24)*100
| search availability_percentage < 95
| table availability_percentage,Service, ServiceOffering,AssignmentGroup,Priority
| appendpipe[
| stats count
| where count=0
| appendcols [| eval availability_percentage=0,Service=random_service,AssignmentGroup=random_group etc
| table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority
]]
| dedup availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority
| table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority
if the percentage is less than 95% then we will trigger an email and create a ServiceNow incident through the row that is returned in the Splunk search
but in case the index didn't receive the data per hour due to some error,
how to check that and still return a dummy result only if no results are returned
but not to return the dummy result in the append-pipe section in the case where availability is less than 95%
You could try something like this
| appendpipe
[| stats count
| where count=0
| eval availability_percentage=101]
| search availability_percentage < 95 OR availability_percentage > 100
| appendpipe
[| stats count
| where count = 0
| eval eval availability_percentage=0,Service="random_service",ServiceOffering="random_offering", AssignmentGroup="random_group", Priority=1
| table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority]
Note that your original appendpipe doesn't need to appendcols since, at this point, there are no events, so the eval of the dummy fields is sufficient.