topic Adding new expected Value to serach result in Splunk Search

Adding new expected Value to serach result

mikroice90 — Thu, 05 Nov 2020 11:36:33 GMT

Hi,

I tried search some data from logs using this statement:

index=* sourcetype="mySource" Types* | stats count by Types

in result I receive table like this:

Type1	5
Type2	4
Type3	1

I know that in the future in logs can occur Type4 so I would like to add it in to serach result by force. I tried some lookup stuff but i cant use it properly to get expected result.

So for now I would like to have table like this:

Type1	5
Type2	4
Type3	1
Type4	0

Thanks in advice for help.

Re: Adding new expected Value to serach result

inventsekar — Thu, 05 Nov 2020 12:11:23 GMT

Hi @mikroice90 .. maybe, check this idea -
EDIT - using eval, we can check if type4 exist, if its null, assign a zero value.

index=* sourcetype="mySource" Types* | eval type4=if(isnull(type4),0,type4) | stats count by Types

Re: Adding new expected Value to serach result

mikroice90 — Thu, 05 Nov 2020 12:09:52 GMT

@inventsekar how it works in case: when logs with type4 will exist? It will still shows 0 instead of count value?

Re: Adding new expected Value to serach result

inventsekar — Thu, 05 Nov 2020 12:26:03 GMT

Hi @mikroice90

the if condition is checking if type4 is null, then it adds type4=0, if it is not null, then it will take the current value of type4.

Re: Adding new expected Value to serach result

mikroice90 — Thu, 05 Nov 2020 13:14:42 GMT

Brilliant, thanks a lot

One more question, This strings "Type1,Types2" etc. exist in more than one field in data set. Is it possible to count it all together instead of counting only by Types?

Re: Adding new expected Value to serach result

isoutamo — Thu, 05 Nov 2020 15:08:30 GMT

Please send example of events, so we could help you easier.
r. Ismo