Dashboards & Visualizations

Create dash with predefined row labels

ShagVT
Path Finder

Hi folks, I'm trying to put together a dash that will help me find MISSING values.  So I would like to put together a chart that has rows based on values from a CSV, even if the record has no value.

So let's say the data are something simple like this:

06:25     foo

06:27     bar

06:27     foo

06:27     foo

 

And then I want an output that looks like this:

Label        count

bar             1

foo             3

blah            0

Notice that there is no "blah" row in my sample data.  I would have a CSV with those three rows (in reality my file will have many rows).  I've never used inputlookup for something like this, and I'm wondering if it is even possible. 

Any help is most welcome!

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Inputlookup is easy. Just do

| inputlookup <your.lookup.csv>

And you got yourself a nice table which you can pipe to any evals, stats or do any other transformation  you want.

The problem is finding the "misses". It really depends on what you want to do. Because if you just want to count some parsed fields, it's relatively easy, as per the solution thah Rich showed.

But if you want to do a fully blown search for each of the terms from the lookup, well that'd have to involve the | map [subsearch] operation and is going to be highly ineffective (especially if you have many rows in your lookup).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

ShagVT
Path Finder

This is EXACTLY what I needed.  Thank you!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...