topic Re: Add row to chart from lookup file in Splunk Search

How to add row to chart from lookup file?

boxmetal — Mon, 05 Sep 2022 21:21:48 GMT

Hi Splunk community,

I want to chart the data retrieved from index, filter the app_name field to match with ones in the lookup file. There will be some app_name values in lookup file not in the index, and they need to be added as new rows and labeled "Not executed" for their status.

My SPL looks like below:

Here what I got:

App	Stage A	Stage B	Stage C	Stage D
App_A	PASSED	FAILED	PASSED	PASSED

And I want it to look like this:

App	Stage A	Stage B	Stage C	Stage D
App_A	PASSED	FAILED	PASSED	PASSED
App_B	Not executed	Not executed	Not executed	Not executed
...	Not executed	Not executed	Not executed	Not executed

Please help and advise,

Thanks!

Re: Add row to chart from lookup file

ITWhisperer — Mon, 05 Sep 2022 10:07:00 GMT

Try something like this

Re: Add row to chart from lookup file

boxmetal — Mon, 05 Sep 2022 11:04:14 GMT

I tried to add the append command under the subsearch, but it does not chart as expected.

The "Not Executed" values is added to stage_name field, and all previous field become null.

App	Stage - Not Executed	NULL
App_A	Not Executed	FAILED PASSED
App_B	Not Executed	Not Executed
...	Not Executed	Not Executed

Re: Add row to chart from lookup file

ITWhisperer — Mon, 05 Sep 2022 11:22:33 GMT

What was the search you used for this result?

Re: Add row to chart from lookup file

boxmetal — Tue, 06 Sep 2022 02:29:29 GMT

I added it append command under the subsearch like this:

And for your provided search, the chart result I got only has app_name field. So I changed it like above but seem no luck so far

Re: Add row to chart from lookup file

ITWhisperer — Tue, 06 Sep 2022 09:32:04 GMT