Hi everyone,
I have a workflow which connects and queries the splunk.
Some times the splunk queries succeed,but wouldn't fetch any events for that particular time range.
It would generally output following fields
key=done and sid="some value"
Total count field will be empty
Now I need to create a workflow based on the condition, if key=done and sid is present and total count is empty or 0
Then it should follow one specific flow, where it generates date column from the fields called start date and end date in the workflow and assign a value as 0 for that date in new column.
And suppose If there are events generated from the splunk query and total count!=0 then it should follow a different flow, I have in place.
How do i achieve this? Appreciate your help
Solved! Go to Solution.
@Lalith27 Use filter tool to filter 'Total count' field and follow 1 flow for 'True' output and other flow for 'False' output