topic Re: search to find Bush's stolen watch in Splunk Search

search to find Bush's stolen watch

ledion — Tue, 06 Mar 2018 17:12:24 GMT

Does anyone know how to craft a search to find George Bush's stolen watch?

Re: search to find Bush's stolen watch

skoelpin — Tue, 06 Mar 2018 18:15:57 GMT

Yeah, try this

index=... sourcetype=... 
| stats count(watch) by president
| search president="Bush_W"
| rename count(watch) AS passed_to_secret_service_agent
| eval where_is_stolen_watch=if(passed_to_secret_service_agent>0,"The U.S. gov forgot to give it back","The watch was stolen")
| table president where_is_stolen_watch

Re: search to find Bush's stolen watch

martin_mueller — Tue, 06 Mar 2018 18:59:25 GMT

Nuh-uh. Stats count by field will never yield zeroes.

Re: search to find Bush's stolen watch

ledion — Tue, 06 Mar 2018 21:36:02 GMT

don't we need some geostats ?

Re: search to find Bush's stolen watch

paulbannister — Wed, 07 Mar 2018 14:29:53 GMT

Indeed, you'd have to table all the presidents afterwards and fillnull to get those zeroes, that could get tedious, are we also assuming that both pocket and wrist have been classified under the watch field?

Re: search to find Bush's stolen watch

yannK — Wed, 07 Mar 2018 22:32:55 GMT

Only if it was a smart watch with GPS positioning.

Re: search to find Bush's stolen watch

skoelpin — Wed, 07 Mar 2018 22:54:01 GMT

Line 3 will narrow down to only search "Bush_W". When I googled this scenario, the first thing I saw was that the secret service grabbed it before it was stolen and never gave it back, so I went with it. The answer will always return this if that president ever owned a watch

**President**  | **Where_is_stolen_watch**
Bush_W             | "The U.S. gov forgot to give it back

Re: search to find Bush's stolen watch

DalJeanis — Thu, 08 Mar 2018 01:00:15 GMT

SInce there are so many presidents and watches in the index, you'd want to be in the habit of checking identity of the president first, rather than wasting all those mips counting up the other couple of hundred records.

Also, since typists may get confused between the various George Bush presidents, and because the name can appear in various forms, you might be better off testing for something like...

| search (first_name="George" AND last_name="Bush") OR president_number = 43