topic how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count ) in Splunk Search

how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count )

dtccsundar — Fri, 19 Nov 2021 10:31:42 GMT

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" | stats values(*) as * by sysid |eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") | table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

sourcetype	ITAM_sysid	ITAM Name	Fire Agent Version	Compare Agent Version	Status
Compare Fire	0003fb	SALINU0016	32.30.	6.3	Not Covered
Compare Fire	003fcb	SGGRNP1002	29.7		Not Covered
Fire	0d456	SADAPP0002	32.3		Covered
Compare	0d526	SWZWZQ0001			Not Covered

Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting not covered instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

Re: how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count )

ITWhisperer — Fri, 19 Nov 2021 13:13:37 GMT

Try with the fillnull after the stats

index=A sourcetype IN (Compare,Fire) | search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" | stats values(*) as * by sysid | fillnull value="" | eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") | table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

Re: how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count )

dtccsundar — Fri, 19 Nov 2021 18:31:34 GMT

This worked Perfectly . Thank You !!