Splunk Search

Add a for loop on eval command for number of hosts

ssaenger
Communicator

Hi,

i have a query that returns two lines of results based on two hosts.
i then get a result from another query that only returns one line.
When i do the eval command i get a correct 'Match' for the first line but no entry for the second.

How do i apply the 'appendcol' result to both lines?

index =systems sourcetype = stream_stack PID=0x0055 
|  eval Packets=packets*208 
 | stats  latest(Packets) AS Packets by host 
|  appendcols 
    [ search index=systems sourcetype=soms_file_size process=soms  | stats  latest(file_size) AS file_size latest(file_name) AS file_name by process ]
     | eval match=if(Packets=file_size,"OK","Error")
     | table process match Packets file_size file_name host

RESULT

process  match            file_size file_name                                                   host
soms       OK                     27666832  DR_270919_P_5068_719_750_750.out                             chietrp01
           Error                                                                               chietrp02

thanks,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That's the way appendcols works. The results from search 2 are added to the results from search 1 on a one-to-one basis. If there are fewer results in search 2 then some results from search 1 will not have the added columns. Also, note that the order in which the results are returned from each search should be the same so the one-to-one pairing of results makes sense.

If you need the results from search 2 to be replicated to all results of search 1 then perhaps filldown will do.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ssaenger
Communicator

Thank you richgalloway this worked.

For those seeking solution, here is the code for filldown, nice and easy -

 index =systems sourcetype = stream_stack PID=0x0055 
 |  eval Packets=packets*208 
  | stats  latest(Packets) AS Packets by host 
 |  appendcols 
     [ search index=systems sourcetype=soms_file_size process=soms  | stats  latest(file_size) AS file_size latest(file_name) AS file_name by process ]
      | filldown process, file_size, file_name
      | eval match=if(Packets=file_size,"OK","Error")
      | table process match Packets file_size file_name host
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's the way appendcols works. The results from search 2 are added to the results from search 1 on a one-to-one basis. If there are fewer results in search 2 then some results from search 1 will not have the added columns. Also, note that the order in which the results are returned from each search should be the same so the one-to-one pairing of results makes sense.

If you need the results from search 2 to be replicated to all results of search 1 then perhaps filldown will do.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...