Splunk Enterprise

How do I fill my null field from a subsearch?

jsven7
Communicator

Situation:

  • The data I need resides in the below:

 

 

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

Problem:

  • "fieldD" only has a value when I modify the search as such:

 

 

index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

--------------------------------------

Based on my research I presume I am 100% incorrect but I've been trying to use join with no success. I suspect the answer is to use a subsearch however I can't figure out how to construct it so that I can always get a value for "fieldD". Any help would be greatly appreciated.

Labels (1)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value="N/A" fieldD
0 Karma

jsven7
Communicator
index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)

Apologies I failed to mention that I actually need to retrieve the value of "field D" from the above search so that its displayed in the below search:

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(fieldD) as fieldD by fieldC, fieldE, fieldB
0 Karma

jsven7
Communicator

Thank you for your assistance. That did not work. Here is the join example I attempted. It might give a better idea at the problem I'm facing:

 

index=X
``` Dataset 1. When fieldA has a value fieldD is missing. ```
(sourcetype=sourcetypeA fieldA=X) OR 

``` Dataset 2. When fieldA has a value fieldD is missing.  ```
(sourcetype=sourcetypeB fieldB=X)

| rename fieldA as fieldB

| fillnull value="N/A" fieldD

``` This is the only way I presume I can append fieldD to my dataset. fieldD is only available when fieldA and fieldB above don't have values. ```
| join type=left fieldC [search index=X sourcetype IN (sourcetypeA,sourcetypeB) fieldD="*"]

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

Problem: fieldD="N/A"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on your actual events, try something like this

index=X (sourcetype=sourcetypeA OR sourcetype=sourcetypeB)

| eval fieldB = coalesce(fieldB, fieldA)

| eventstats values(fieldD) as fieldD by fieldC

| where fieldA=X OR fieldB=X

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...