topic Re: How to group by forcing line value in Splunk Search

How to group by forcing line value

matimat — Mon, 04 Nov 2019 20:02:39 GMT

Hi,

I want to show how many lines contains some value even if no line return.

My data :

Row 1 :
F1: a
Row 2 :
F1: b

Result desired on table :
F1 => Nb
a => 1
b => 1
c => 0

Re: How to group by forcing line value

arjunpkishore5 — Mon, 04 Nov 2019 21:02:31 GMT

Do you have a master list of all possible values for F1? If yes, is it in a lookup file?

Re: How to group by forcing line value

nplamondon — Tue, 05 Nov 2019 00:22:19 GMT

@woodcock answered a very similar question a while back. Check out https://answers.splunk.com/answers/566928/how-to-find-missing-values-from-a-search-events-co-1.html

Re: How to group by forcing line value

woodcock — Tue, 05 Nov 2019 02:12:12 GMT

Like this:

|makeresults
| eval host="All real events will have a 'host' value"
| eval F1="a b"
| makemv F1
| mvexpand F1

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| append [|makeresults
| rename COMMENT AS "This would better be done using a 'lookup' file with ' |inputlookup append=t' instead of '|makeresults ...'"
| eval F1="a b c d e f list all possible values here"
| makemv F1 ]
| stats count(host) AS Nb BY F1

Re: How to group by forcing line value

matimat — Tue, 05 Nov 2019 08:16:06 GMT

Thanks your solution works. I add this :