Dashboards & Visualizations

Create dash with predefined row labels

ShagVT
Path Finder

Hi folks, I'm trying to put together a dash that will help me find MISSING values.  So I would like to put together a chart that has rows based on values from a CSV, even if the record has no value.

So let's say the data are something simple like this:

06:25     foo

06:27     bar

06:27     foo

06:27     foo

 

And then I want an output that looks like this:

Label        count

bar             1

foo             3

blah            0

Notice that there is no "blah" row in my sample data.  I would have a CSV with those three rows (in reality my file will have many rows).  I've never used inputlookup for something like this, and I'm wondering if it is even possible. 

Any help is most welcome!

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

PickleRick
Ultra Champion

Inputlookup is easy. Just do

| inputlookup <your.lookup.csv>

And you got yourself a nice table which you can pipe to any evals, stats or do any other transformation  you want.

The problem is finding the "misses". It really depends on what you want to do. Because if you just want to count some parsed fields, it's relatively easy, as per the solution thah Rich showed.

But if you want to do a fully blown search for each of the terms from the lookup, well that'd have to involve the | map [subsearch] operation and is going to be highly ineffective (especially if you have many rows in your lookup).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.

ShagVT
Path Finder

This is EXACTLY what I needed.  Thank you!

Tags (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>