topic Appendpipe alters field values when not null in Splunk Search

Appendpipe alters field values when not null

ebs — Thu, 01 Jul 2021 04:07:55 GMT

Hi,

I'm inserting an appendpipe into my SPL so that in the event there are no results, a stats table will still be produced.

However, I am seeing differences in the field values when they are not null. Can anyone explain why this is occurring and how to fix this?

Re: Appendpipe alters field values when not null

ebs — Thu, 01 Jul 2021 04:08:32 GMT

SPL results when there is no appendpipe

Re: Appendpipe alters field values when not null

kamlesh_vaghela — Thu, 01 Jul 2021 07:06:32 GMT

@ebs

have you tried appendcols ?

Re: Appendpipe alters field values when not null

ebs — Thu, 01 Jul 2021 22:35:18 GMT

Using appendcols, there are still differences

lowPriority, unattended, and largePayload still differ from the values when not using an appendcol/appendpipe

Re: Appendpipe alters field values when not null

ebs — Thu, 01 Jul 2021 22:36:26 GMT

Re: Appendpipe alters field values when not null

kamlesh_vaghela — Fri, 02 Jul 2021 06:18:54 GMT

@ebs

Well if you want to display the Tier for which the events are not available OR has no count, I think append pipe or append column will not help you.

But as you are doing transpose and fields in you further searches I would like to suggest you below search.

YOUR_DATAMODEL_SEARCH | stats count as averageResponse by Tier | eval averageResponse=round(averageResponse,3) | transpose 0 header_field="Tier" | eval _time=now() | fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time | fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

My Sample Search :

| makeresults | eval Tier="unaithenticated,highPriority,lowPrioriy",Tier=split(Tier,",") | stats count as averageResponse by Tier | eval averageResponse=round(averageResponse,3) | transpose 0 header_field="Tier" | eval _time=now() | fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time | fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.