Splunk Search

Display field based on value of another field

bleung93
Path Finder

I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?

| btool indexes | search sos_server="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sos_server="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.

0 Karma

bleung93
Path Finder

You said that the server and path are linked together while eval sos_server_homePath. So does that mean you cannot link other fields with a field already linked?

0 Karma

bleung93
Path Finder

This is what I needed. Thanks Martin for the help!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1

Adding a by sos_server would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.

0 Karma

bleung93
Path Finder

Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sos_server), it is separated by each distinct sos_server field?

Linking the distinct sos_server to the corresponding homePath's.

0 Karma

bleung93
Path Finder

This is to compare index paths on different indexers to see if they are configured properly according to guidelines.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!