topic Bring back set number of fields even if the field isn't in the data in Splunk Search

Bring back set number of fields even if the field isn't in the data

jlechem — Thu, 03 Mar 2011 04:28:50 GMT

Hello,

I am trying to bring back a set number of fields in a query even if that field isn't in the indexed data. For example, my data could have a field called Status. Status could be one of 3 values a, b, or c. My data only happens to have a and b with no c. I want my queries to always bring back count values for a, b, and c with 0 for any field value that's not in the current data. Is this possible?

Re: Bring back set number of fields even if the field isn't in the data

Stephen_Sorkin — Thu, 03 Mar 2011 05:14:36 GMT

Could you share your exact search?

Re: Bring back set number of fields even if the field isn't in the data

bbingham — Thu, 03 Mar 2011 14:20:22 GMT

Yes it's possible, you can use the eval command under the count, it will only count if it matches a set outcome, here's a sample:

 source="some source" | stats count(eval(Status="a")) as Name_of_field_A count(eval(Status="b")) as Name_of_field_B count(eval(Status="c")) as Name_of_field_C

The above will always return the 3 fields and will stay at 0 till they encounter a match on the status field. Is that what you're looking for?

Re: Bring back set number of fields even if the field isn't in the data

jlechem — Fri, 04 Mar 2011 23:58:05 GMT

That's exactly what I'm looking for thanks!