Splunk Search

Appendpipe alters field values when not null

ebs
Communicator

Hi,

I'm inserting an appendpipe into my SPL so that in the event there are no results, a stats table will still be produced.

However, I am seeing differences in the field values when they are not null. Can anyone explain why this is occurring and how to fix this?

 

Labels (6)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ebs 

Well if you want to display the Tier for which the events are not available OR has no count, I think append pipe or append column will not help you.

But as you are doing  transpose and fields in you further searches I would like to suggest you below search.

YOUR_DATAMODEL_SEARCH 
| stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

 

My Sample Search :

| makeresults | eval Tier="unaithenticated,highPriority,lowPrioriy",Tier=split(Tier,",") | stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ebs 

have you tried appendcols ?

0 Karma

ebs
Communicator

Using appendcols, there are still differences

lowPriority, unattended, and largePayload still differ from the values when not using an appendcol/appendpipe

0 Karma

ebs
Communicator
 
0 Karma

ebs
Communicator

SPL results when there is no appendpipe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...