Splunk Search

Combining 2 outputs together to form a single output table

jerinvarghese
Communicator

Hi All,

I want a small addition to the output values.

Code am using : 

 

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| table nodelabel Status

 

 

Output table : 

nodelabel Status

INBLR-LANCCO001Up
INBLR-LANCUA002Up
INBLR-LANCUA004Up
INBLR-LANCUA006Up
INBLR-LANCUA007 
INBLR-LANCUA008Up
INBLR-WANRTC001Up
INBLR-WANRTC002Up
INBLR-WANRTC003 

 

Reason some device not having status is, SNMP polling didnt happened for that device.

I want a simplified output as expected below.

Additional line of code: 

 

| eval Device= nodelabel." [".Status."]"

 

 

Device

INBLR-LANCCO001 [Up]
INBLR-LANCUA002 [Up]
INBLR-LANCUA004 [Up]
INBLR-LANCUA006 [Up]
 
INBLR-LANCUA008 [Up]
INBLR-WANRTC001 [Up]
INBLR-WANRTC002 [Up]
 

 

Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked. 

please help me with it.

Labels (8)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...