topic Conditional timechart condiftion in Dashboards & Visualizations

Conditional timechart condiftion

gjhaaland — Thu, 09 Nov 2023 09:29:47 GMT

Hi,

Not sure how to fix it. Hope someone can give me a hint. The code looks like

index=asa host=1.2.3.4 src_sg_info=*

| timchart span=10m dc(src_sg_info) by src_sg_info

| rename user1 as "David E"

This splunk code will give a list with active/logged on VPN user. So far so good. So my question is following: howto include empty src_sg_info into the same timechart and mark it as "No active VPN user"

Re: Conditional timechart condiftion

FelixLeh — Thu, 09 Nov 2023 10:49:47 GMT

index=asa host=1.2.3.4 | fillnull src_sg_info value="No active VPN user" | timechart span=10m dc(src_sg_info) by src_sg_info | rename user1 as "David E"

Re: Conditional timechart condiftion

gjhaaland — Thu, 09 Nov 2023 10:38:36 GMT

Thanks, is it possible to

if field src_sg_info does not exist then "No active VPN user" in the same timechart.

Re: Conditional timechart condiftion

gjhaaland — Mon, 13 Nov 2023 08:23:06 GMT

Thanks,

Does not work. Also know following. If src_sg_info does not exist then we know that it's no active VPN user. Does not know how to test src_sg_info existance. Thnaks again.

Rgds

Geir