Hi folks, I'm trying to put together a dash that will help me find MISSING values. So I would like to put together a chart that has rows based on values from a CSV, even if the record has no value.
So let's say the data are something simple like this:
06:25 foo
06:27 bar
06:27 foo
06:27 foo
And then I want an output that looks like this:
Label count
bar 1
foo 3
blah 0
Notice that there is no "blah" row in my sample data. I would have a CSV with those three rows (in reality my file will have many rows). I've never used inputlookup for something like this, and I'm wondering if it is even possible.
Any help is most welcome!
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
Inputlookup is easy. Just do
| inputlookup <your.lookup.csv>
And you got yourself a nice table which you can pipe to any evals, stats or do any other transformation you want.
The problem is finding the "misses". It really depends on what you want to do. Because if you just want to count some parsed fields, it's relatively easy, as per the solution thah Rich showed.
But if you want to do a fully blown search for each of the terms from the lookup, well that'd have to involve the | map [subsearch] operation and is going to be highly ineffective (especially if you have many rows in your lookup).
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/