Splunk Enterprise

How do I fill my null field from a subsearch?

jsven7
Communicator

Situation:

  • The data I need resides in the below:

 

 

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

Problem:

  • "fieldD" only has a value when I modify the search as such:

 

 

index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

 

 

--------------------------------------

Based on my research I presume I am 100% incorrect but I've been trying to use join with no success. I suspect the answer is to use a subsearch however I can't figure out how to construct it so that I can always get a value for "fieldD". Any help would be greatly appreciated.

Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value="N/A" fieldD
0 Karma

jsven7
Communicator
index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)

Apologies I failed to mention that I actually need to retrieve the value of "field D" from the above search so that its displayed in the below search:

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(fieldD) as fieldD by fieldC, fieldE, fieldB
0 Karma

jsven7
Communicator

Thank you for your assistance. That did not work. Here is the join example I attempted. It might give a better idea at the problem I'm facing:

 

index=X
``` Dataset 1. When fieldA has a value fieldD is missing. ```
(sourcetype=sourcetypeA fieldA=X) OR 

``` Dataset 2. When fieldA has a value fieldD is missing.  ```
(sourcetype=sourcetypeB fieldB=X)

| rename fieldA as fieldB

| fillnull value="N/A" fieldD

``` This is the only way I presume I can append fieldD to my dataset. fieldD is only available when fieldA and fieldB above don't have values. ```
| join type=left fieldC [search index=X sourcetype IN (sourcetypeA,sourcetypeB) fieldD="*"]

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

Problem: fieldD="N/A"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on your actual events, try something like this

index=X (sourcetype=sourcetypeA OR sourcetype=sourcetypeB)

| eval fieldB = coalesce(fieldB, fieldA)

| eventstats values(fieldD) as fieldD by fieldC

| where fieldA=X OR fieldB=X

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

 

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...