Splunk Search

Display field based on value of another field

bleung93
Path Finder

I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?

| btool indexes | search sos_server="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sos_server="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

martin_mueller
SplunkTrust
SplunkTrust

That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.

0 Karma

bleung93
Path Finder

You said that the server and path are linked together while eval sos_server_homePath. So does that mean you cannot link other fields with a field already linked?

0 Karma

bleung93
Path Finder

This is what I needed. Thanks Martin for the help!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1

Adding a by sos_server would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.

0 Karma

bleung93
Path Finder

Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sos_server), it is separated by each distinct sos_server field?

Linking the distinct sos_server to the corresponding homePath's.

0 Karma

bleung93
Path Finder

This is to compare index paths on different indexers to see if they are configured properly according to guidelines.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...