Splunk Search

Combining 2 outputs together to form a single output table

jerinvarghese
Communicator

Hi All,

I want a small addition to the output values.

Code am using : 

 

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| table nodelabel Status

 

 

Output table : 

nodelabel Status

INBLR-LANCCO001Up
INBLR-LANCUA002Up
INBLR-LANCUA004Up
INBLR-LANCUA006Up
INBLR-LANCUA007 
INBLR-LANCUA008Up
INBLR-WANRTC001Up
INBLR-WANRTC002Up
INBLR-WANRTC003 

 

Reason some device not having status is, SNMP polling didnt happened for that device.

I want a simplified output as expected below.

Additional line of code: 

 

| eval Device= nodelabel." [".Status."]"

 

 

Device

INBLR-LANCCO001 [Up]
INBLR-LANCUA002 [Up]
INBLR-LANCUA004 [Up]
INBLR-LANCUA006 [Up]
 
INBLR-LANCUA008 [Up]
INBLR-WANRTC001 [Up]
INBLR-WANRTC002 [Up]
 

 

Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked. 

please help me with it.

Labels (8)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...