Splunk Enterprise

How do I fill my null field from a subsearch?

jsven7
Communicator

Situation:

  • The data I need resides in the below:

 

 

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

Problem:

  • "fieldD" only has a value when I modify the search as such:

 

 

index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

--------------------------------------

Based on my research I presume I am 100% incorrect but I've been trying to use join with no success. I suspect the answer is to use a subsearch however I can't figure out how to construct it so that I can always get a value for "fieldD". Any help would be greatly appreciated.

Labels (1)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value="N/A" fieldD
0 Karma

jsven7
Communicator
index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)

Apologies I failed to mention that I actually need to retrieve the value of "field D" from the above search so that its displayed in the below search:

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(fieldD) as fieldD by fieldC, fieldE, fieldB
0 Karma

jsven7
Communicator

Thank you for your assistance. That did not work. Here is the join example I attempted. It might give a better idea at the problem I'm facing:

 

index=X
``` Dataset 1. When fieldA has a value fieldD is missing. ```
(sourcetype=sourcetypeA fieldA=X) OR 

``` Dataset 2. When fieldA has a value fieldD is missing.  ```
(sourcetype=sourcetypeB fieldB=X)

| rename fieldA as fieldB

| fillnull value="N/A" fieldD

``` This is the only way I presume I can append fieldD to my dataset. fieldD is only available when fieldA and fieldB above don't have values. ```
| join type=left fieldC [search index=X sourcetype IN (sourcetypeA,sourcetypeB) fieldD="*"]

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

Problem: fieldD="N/A"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on your actual events, try something like this

index=X (sourcetype=sourcetypeA OR sourcetype=sourcetypeB)

| eval fieldB = coalesce(fieldB, fieldA)

| eventstats values(fieldD) as fieldD by fieldC

| where fieldA=X OR fieldB=X

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...