topic Re: Add a for loop on eval command for number of hosts in Splunk Search

Add a for loop on eval command for number of hosts

ssaenger — Thu, 21 May 2020 11:19:59 GMT

Hi,

i have a query that returns two lines of results based on two hosts.
i then get a result from another query that only returns one line.
When i do the eval command i get a correct 'Match' for the first line but no entry for the second.

How do i apply the 'appendcol' result to both lines?

index =systems sourcetype = stream_stack PID=0x0055 
|  eval Packets=packets*208 
 | stats  latest(Packets) AS Packets by host 
|  appendcols 
    [ search index=systems sourcetype=soms_file_size process=soms  | stats  latest(file_size) AS file_size latest(file_name) AS file_name by process ]
     | eval match=if(Packets=file_size,"OK","Error")
     | table process match Packets file_size file_name host

RESULT

process  match            file_size file_name                                                   host
soms       OK                     27666832  DR_270919_P_5068_719_750_750.out                             chietrp01
           Error                                                                               chietrp02

thanks,

Re: Add a for loop on eval command for number of hosts

richgalloway — Thu, 21 May 2020 12:46:48 GMT

That's the way appendcols works. The results from search 2 are added to the results from search 1 on a one-to-one basis. If there are fewer results in search 2 then some results from search 1 will not have the added columns. Also, note that the order in which the results are returned from each search should be the same so the one-to-one pairing of results makes sense.

If you need the results from search 2 to be replicated to all results of search 1 then perhaps filldown will do.

Re: Add a for loop on eval command for number of hosts

ssaenger — Sun, 24 May 2020 08:43:48 GMT

Thank you richgalloway this worked.

For those seeking solution, here is the code for filldown, nice and easy -

 index =systems sourcetype = stream_stack PID=0x0055 
 |  eval Packets=packets*208 
  | stats  latest(Packets) AS Packets by host 
 |  appendcols 
     [ search index=systems sourcetype=soms_file_size process=soms  | stats  latest(file_size) AS file_size latest(file_name) AS file_name by process ]
      | filldown process, file_size, file_name
      | eval match=if(Packets=file_size,"OK","Error")
      | table process match Packets file_size file_name host