topic Showing table despite no result in Splunk Search

Showing table despite no result

k31453 — Wed, 26 Aug 2020 04:53:06 GMT

Hi, I have base search which has appname field which lists all apps I have on splunk instance. I would like to output table or static in which it says whether apps a,b,c,d are present. If it is what it is version and what indexers are installed at. If there is no result found in base search, i would still like to see output as all a-d apps as absent status.

I already have base search :

index=.. host=... AND appname IN (a,b,c,d)

Re: Showing table despite no result

richgalloway — Wed, 26 Aug 2020 12:57:00 GMT

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

Re: Showing table despite no result

k31453 — Thu, 27 Aug 2020 08:06:42 GMT

This is not much helping as this is bit odd case.

Re: Showing table despite no result

to4kawa — Thu, 27 Aug 2020 11:17:57 GMT