topic Re: How do you get all matching and non-matching rows from a Splunk search and lookup? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449222#M127216 <P>That is perfect Chris. Thank you very much. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 08 Feb 2019 11:55:35 GMT Shashank_87 2019-02-08T11:55:35Z How do you get all matching and non-matching rows from a Splunk search and lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449219#M127213 <P>Hi, </P> <P>I am working on a query where I have to match the responseCode from the search to the responseCode in a lookup I created. That lookup contains the responseCode and its description.</P> <P>Now there are a few cases where the responseCode in the search does not match to anything in the lookup table. I want the count of all responseCodes. If it matches in the lookup then with its description, and if it doesn't match, then the description would be null, but I want the count. </P> <P>My current search is not giving the count of the unmatched responseCode —</P> <PRE><CODE>index="test" sourcetype="test_log" | dedup time,host,source,_raw | lookup Response_Codes_Desc ResponseCode | stats count by ResponseCode Description | sort - count </CODE></PRE> <P>Please could someone help on this?</P> Fri, 08 Feb 2019 11:24:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449219#M127213 Shashank_87 2019-02-08T11:24:24Z Re: How do you get all matching and non-matching rows from a Splunk search and lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449220#M127214 <P>what about this:</P> <PRE><CODE>index="test" sourcetype="test_log" | dedup time,host,source,_raw | lookup Response_Codes_Desc ResponseCode | eval Description = coalesce(Description, "") | stats count by ResponseCode Description | sort - count </CODE></PRE> Fri, 08 Feb 2019 11:41:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449220#M127214 chrisyounger 2019-02-08T11:41:26Z Re: How do you get all matching and non-matching rows from a Splunk search and lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449221#M127215 <P>Check if this helps:<BR /> index="test" sourcetype="test_log" <BR /> | dedup time,host,source,_raw <BR /> | lookup Response_Codes_Desc ResponseCode<BR /> | eval NoMatch = if(isnull(Description), 1, 0)<BR /> | eventstats sum(NoMatch) as NoMatch, sum(eval(if(NoMatch = 0, 1, 0))) as MatchAvailable </P> Tue, 29 Sep 2020 23:07:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449221#M127215 jvishwak 2020-09-29T23:07:13Z Re: How do you get all matching and non-matching rows from a Splunk search and lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449222#M127216 <P>That is perfect Chris. Thank you very much. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 08 Feb 2019 11:55:35 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-all-matching-and-non-matching-rows-from-a-Splunk/m-p/449222#M127216 Shashank_87 2019-02-08T11:55:35Z