Splunk Search
Highlighted

Display field based on value of another field

Path Finder

I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?

| btool indexes | search sosserver="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sosserver="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error

Tags (4)
0 Karma
Highlighted

Re: Display field based on value of another field

Path Finder

This is to compare index paths on different indexers to see if they are configured properly according to guidelines.

0 Karma
Highlighted

Re: Display field based on value of another field

SplunkTrust
SplunkTrust

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

View solution in original post

Highlighted

Re: Display field based on value of another field

Path Finder

Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sosserver), it is separated by each distinct sosserver field?

Linking the distinct sos_server to the corresponding homePath's.

0 Karma
Highlighted

Re: Display field based on value of another field

SplunkTrust
SplunkTrust

You could do this:

| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1

Adding a by sos_server would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.

0 Karma
Highlighted

Re: Display field based on value of another field

Path Finder

This is what I needed. Thanks Martin for the help!

0 Karma
Highlighted

Re: Display field based on value of another field

Path Finder

You said that the server and path are linked together while eval sosserverhomePath. So does that mean you cannot link other fields with a field already linked?

0 Karma
Highlighted

Re: Display field based on value of another field

SplunkTrust
SplunkTrust

That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.

0 Karma