Query return value if NULL event

obiwan1129 — Fri, 17 Nov 2017 21:52:49 GMT

I have a query I'm working on where not all the values I feed it are in the index I am querying against.

For example suppose I have two emails, lrhg@gmail.com and charlie.brown@peanuts.com

index=windows sourcetype=ActiveDirectory lrhg@gmail.com OR charlie.brown@peanuts.com | dedup name

Currently only charlie.brown@peanuts.com is in the index. As a result I only return the Event for charlie.brown@peanuts.com.

I'd like to have my query return two records for lrhg@gmail.com and charlie.brown@peanuts.com even if there are no results for lrhg@gmail.com. Something where the event is essentially blank except for the lrhg@gmail.com value

Any thoughts out there?

Re: Query return value if NULL event

DalJeanis — Fri, 17 Nov 2017 23:29:23 GMT

Use append to add a blank record for each. Look at the makeresults command for one each way to do it.

index=windows sourcetype=ActiveDirectory lrhg@gmail.com OR charlie.brown@peanuts.com 
| append [
    | makeresults 
    | eval name="lrhg@gmail.com charlie.brown@peanuts.com" 
    | makemv name 
    | mvexpand name 
    | table name
    ]
| dedup name

topic Re: Query return value if NULL event in Splunk Search

Query return value if NULL event

Re: Query return value if NULL event