Splunk Search

Combining 2 outputs together to form a single output table

jerinvarghese
Communicator

Hi All,

I want a small addition to the output values.

Code am using : 

 

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| table nodelabel Status

 

 

Output table : 

nodelabel Status

INBLR-LANCCO001Up
INBLR-LANCUA002Up
INBLR-LANCUA004Up
INBLR-LANCUA006Up
INBLR-LANCUA007 
INBLR-LANCUA008Up
INBLR-WANRTC001Up
INBLR-WANRTC002Up
INBLR-WANRTC003 

 

Reason some device not having status is, SNMP polling didnt happened for that device.

I want a simplified output as expected below.

Additional line of code: 

 

| eval Device= nodelabel." [".Status."]"

 

 

Device

INBLR-LANCCO001 [Up]
INBLR-LANCUA002 [Up]
INBLR-LANCUA004 [Up]
INBLR-LANCUA006 [Up]
 
INBLR-LANCUA008 [Up]
INBLR-WANRTC001 [Up]
INBLR-WANRTC002 [Up]
 

 

Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked. 

please help me with it.

Labels (8)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Add fillnull after the join

| inputlookup ONMS_nodes.csv
| table nodelabel

| join type=outer nodelabel [ search 
 index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| table nodelabel Status ]

| fillnull value="Down" Status

| table nodelabel Status
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...