Splunk Search

Adding new expected Value to serach result

mikroice90
Explorer

Hi,

I tried search some data from logs using this statement:

 

index=* sourcetype="mySource" Types* | stats count by Types 

 

in result I receive table like this:

Type15
Type24
Type31

I know that in the future in logs can occur Type4 so I would like to add it in to serach result by force. I tried some lookup stuff but i cant use it properly to get expected result.

So for now I would like to have table like this:

Type15
Type24
Type31
Type40

Thanks in advice for help.

Labels (2)

inventsekar
SplunkTrust
SplunkTrust

Hi @mikroice90 .. maybe, check this idea -
EDIT - using eval, we can check if type4 exist, if its null, assign a zero value.

 

index=* sourcetype="mySource" Types* | eval type4=if(isnull(type4),0,type4) | stats count by Types 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mikroice90
Explorer
  • @inventsekar  how it works in case: when logs with type4 will exist? It will still shows 0 instead of count value?
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @mikroice90 

the if condition is checking if type4 is null, then it adds type4=0, if it is not null, then it will take the current value of type4. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mikroice90
Explorer

Brilliant, thanks a lot

 

One more question, This strings "Type1,Types2" etc. exist in more than one field in data set. Is it possible to count it all together instead of counting only by Types?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please send example of events, so we could help you easier.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...