Dashboards & Visualizations

Create dash with predefined row labels

ShagVT
Path Finder

Hi folks, I'm trying to put together a dash that will help me find MISSING values.  So I would like to put together a chart that has rows based on values from a CSV, even if the record has no value.

So let's say the data are something simple like this:

06:25     foo

06:27     bar

06:27     foo

06:27     foo

 

And then I want an output that looks like this:

Label        count

bar             1

foo             3

blah            0

Notice that there is no "blah" row in my sample data.  I would have a CSV with those three rows (in reality my file will have many rows).  I've never used inputlookup for something like this, and I'm wondering if it is even possible. 

Any help is most welcome!

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
Ultra Champion

Inputlookup is easy. Just do

| inputlookup <your.lookup.csv>

And you got yourself a nice table which you can pipe to any evals, stats or do any other transformation  you want.

The problem is finding the "misses". It really depends on what you want to do. Because if you just want to count some parsed fields, it's relatively easy, as per the solution thah Rich showed.

But if you want to do a fully blown search for each of the terms from the lookup, well that'd have to involve the | map [subsearch] operation and is going to be highly ineffective (especially if you have many rows in your lookup).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

ShagVT
Path Finder

This is EXACTLY what I needed.  Thank you!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...