Splunk Search

EASY QUESTION: How to search for events that produce a field value of zero

cosullivan66
Explorer

Hi all, wish I could figure this one out myself but I'm stumped. I'm interested in producing a list of all the account IDs that have count(ns2:sessionType=SCHEDULED) = 0. I can produce the following list with this search:

sourcetype="ScreenSharingEvent" | xmlkv | chart count by ns2:accountId ns2:sessionType

ns2:accountId        IMPROMPTU     RECURRING    SCHEDULED

1 545538432972491782 0 0 2

2 1937523452352853511 2 0 5

3 2633426351742639109 7 0 0

I simply want a chart that would list the account with SCHEDULED=0

ns2:accountId

1 2633426351742639109

Thanks for the help!!

Tags (1)
0 Karma

jdunlea_splunk
Splunk Employee
Splunk Employee

Assuming that in this case, the xmlkv command is splitting the KVs correctly, you could do this:

sourcetype="ScreenSharingEvent" | xmlkv | search SCHEDULED=0 | chart count by ns2:accountId ns2:sessionType

cosullivan66
Explorer

Thanks for the reply, but SCHEDULED is a field value corresponding to the field ns2:sessionType, so I want something like count(ns2:sessionType=Scheduled)=0. However this command doesn't work.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...