Splunk ITSI

Show only those filetype name which came in logs , any if filetype is missed than it must show in result

Hemant1
Explorer

Hi , i am facing some issue with query. My question is how to show only those filetype name which came in logs. Check in lookupfile, if any if filetype is missed then it must show in result.

index=sap_bam sourcetype=sap_d059
| lookup sap_filetype.csv filetype as filetype
| dedup source
| stats count by filetype
| rename count as filecount
| eval alertme=if((filecount=0) OR isnull(filecount),1,0)
| fields sourcetype filetype filecount alertme 
| table filetype filecount alertme
0 Karma

woodcock
Esteemed Legend

I cannot understand what you are asking. Perhaps have a colleague review the words that you are using and re-edit to add clarity.

0 Karma

DalJeanis
Legend

It's difficult to make out exactly what the use case is, but we've clarified your question as much as possible.

I believe you are trying to receive an alert when any particular "filetype" has not been seen in a certain length of time.

Here are some answers that have searches you can model

using a lookup as a base list

https://answers.splunk.com/answers/374128/how-do-i-edit-my-inputlookup-search-to-alert-on-mi.html

using tstats to generate a base list

https://answers.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data.html

0 Karma

DalJeanis
Legend

We've updated the title and language to clarify the question, somewhat.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...