topic Re: How to add a dummy row to the table calculating the timings in the Splunk dashboard in Splunk Search

How to add a dummy row to the table calculating the timings in the Splunk dashboard

Anud — Tue, 04 Jun 2024 13:06:35 GMT

How to add a dummy row to the table in the Splunk dashboard.
We are receiving 2 files everyday 4 times in between 6-7:30AM, 11-12:30 PM, 6-7:30PM, 9-10:05PM.
I need output like below if received one file means has to display like missing other file.

Using | makeresults command we can create a row but it is applicable while calculating the timings.

Input :

File	Date
TI7L	03-06-2024 06:52
TI7L	03-06-2024 06:55
TI8L	03-06-2024 11:51
TI8L	03-06-2024 11:50
TI9L	03-06-2024 19:06
TI9L	03-06-2024 19:10
TI5L	03-06-2024 22:16
TI5L	03-06-2024 22:20

Output:

File	Date
TI7L	03-06-2024 06:52
Missing file
Missing file
TI8L	03-06-2024 11:50
TI9L	03-06-2024 19:06
Missing file
TI5L	03-06-2024 22:16
Missing file

Re: How to add a dummy row to the table calculating the timings in the Splunk dashboard

ITWhisperer — Tue, 04 Jun 2024 14:47:23 GMT

Re: How to add a dummy row to the table calculating the timings in the Splunk dashboard

Anud — Tue, 04 Jun 2024 16:08:07 GMT

Thanks for quick response!

Actually i was looking for the output like below. File missed in between time 6-7:30AM and 9-10:05PM

File	Date
TI7L	03-06-2024 06:52
	file missing
TI8L	03-06-2024 11:51
TI8L	03-06-2024 11:50
TI9L	03-06-2024 19:06
TI9L	03-06-2024 19:10
TI5L	03-06-2024 22:16
	File missing

Re: How to add a dummy row to the table calculating the timings in the Splunk dashboard

richgalloway — Tue, 04 Jun 2024 16:28:48 GMT

Splunk can't find something that's not there. You'll need to use makeresults or a lookup to populate what you expect and then replace that with actual indexed data.