Combining 2 outputs together to form a single output table

jerinvarghese — Sun, 25 Apr 2021 06:34:29 GMT

Hi All,

I want a small addition to the output values.

Code am using :

| inputlookup ONMS_nodes.csv | table nodelabel | join type=outer nodelabel [ search index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel Status ] | table nodelabel Status

Output table :

nodelabel Status

INBLR-LANCCO001	Up
INBLR-LANCUA002	Up
INBLR-LANCUA004	Up
INBLR-LANCUA006	Up
INBLR-LANCUA007
INBLR-LANCUA008	Up
INBLR-WANRTC001	Up
INBLR-WANRTC002	Up
INBLR-WANRTC003

Reason some device not having status is, SNMP polling didnt happened for that device.

I want a simplified output as expected below.

Additional line of code:

| eval Device= nodelabel." [".Status."]"

Device

INBLR-LANCCO001 [Up]

INBLR-LANCUA002 [Up]

INBLR-LANCUA004 [Up]

INBLR-LANCUA006 [Up]

INBLR-LANCUA008 [Up]

INBLR-WANRTC001 [Up]

INBLR-WANRTC002 [Up]

Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked.

please help me with it.

Re: Combining 2 outputs together to form a single output table

ITWhisperer — Sun, 25 Apr 2021 09:09:49 GMT

Add fillnull after the join

topic Combining 2 outputs together to form a single output table in Splunk Search

Combining 2 outputs together to form a single output table

Re: Combining 2 outputs together to form a single output table