Causes a search to fail if the queries and commands that precede it in the search string return zero events or results.
The required syntax is in bold.
- | require
require is used in a search string, it causes the search to fail if the queries and commands that precede it in the search string return zero events or results. When you use it in a subsearch, it causes the parent search to fail when the subsearch fails to return results.
Use this command to prevent the Splunk platform from running zero-result searches when this might have negative side effects, such as generating false positives, running custom search commands that make costly API calls, or creating empty search filters via a subsearch.
require command cannot be used in real-time searches.
1. Stop running a search if it returns zero results or events
... | require
2. Raise an exception if the subsearch returns zero events or results, and stop the parent search.
... [ search index=other_index NOSUCHVALUE | require ]
This documentation applies to the following versions of Splunk® Enterprise: 8.0.5, 8.0.6