Splunk Search

Adding new expected Value to serach result

mikroice90
Explorer

Hi,

I tried search some data from logs using this statement:

 

index=* sourcetype="mySource" Types* | stats count by Types 

 

in result I receive table like this:

Type15
Type24
Type31

I know that in the future in logs can occur Type4 so I would like to add it in to serach result by force. I tried some lookup stuff but i cant use it properly to get expected result.

So for now I would like to have table like this:

Type15
Type24
Type31
Type40

Thanks in advice for help.

Labels (2)

inventsekar
SplunkTrust
SplunkTrust

Hi @mikroice90 .. maybe, check this idea -
EDIT - using eval, we can check if type4 exist, if its null, assign a zero value.

 

index=* sourcetype="mySource" Types* | eval type4=if(isnull(type4),0,type4) | stats count by Types 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mikroice90
Explorer
  • @inventsekar  how it works in case: when logs with type4 will exist? It will still shows 0 instead of count value?
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @mikroice90 

the if condition is checking if type4 is null, then it adds type4=0, if it is not null, then it will take the current value of type4. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mikroice90
Explorer

Brilliant, thanks a lot

 

One more question, This strings "Type1,Types2" etc. exist in more than one field in data set. Is it possible to count it all together instead of counting only by Types?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please send example of events, so we could help you easier.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...