Splunk Search

How to append text in field on result not found

Lukas972
Engager

Let's suppose I have TOTO in successfully in my logs. I want to display the result for TOTO and append that no result found for TITI and TUTU with linecount=0 and their name in UNIT.

Somebody can help me ?

 

| search "successfully"
| makemv delim="," _raw
| table host, unit, linecount
| stats count by unit | where unit IN ("TOTO",TITI",TUTU")
| append [ ... I'm bugging ... ]

 

If there is another way to loop on value, I'm open. I didn't found how to declare and use variable exept with token ...

Labels (2)
Tags (3)
0 Karma
1 Solution

PickleRick
Ultra Champion

There is no "looping" as such in Splunk. You can iterate over the fields in results but that's it. Yes, with some clever trick you can (ab)use this functionality to do "paraprogramming" but that's not what Splunk is about.

See my response to https://community.splunk.com/t5/Splunk-Search/Need-to-display-count-having-zero-events/m-p/565220

 

View solution in original post

0 Karma

PickleRick
Ultra Champion

There is no "looping" as such in Splunk. You can iterate over the fields in results but that's it. Yes, with some clever trick you can (ab)use this functionality to do "paraprogramming" but that's not what Splunk is about.

See my response to https://community.splunk.com/t5/Splunk-Search/Need-to-display-count-having-zero-events/m-p/565220

 

0 Karma

Lukas972
Engager

Thanks, It work !

That's my new code :

<query>
index=mysourcelog "successfully" unit IN ($units_tok$)
| stats by unit
| append [ | makeresults
| eval _raw="TOTO
TUTU
TITI"
| multikv noheader=t
| rename Column_1 as unit
| stats sum(count(linecount)) by unit
</query>
<option name ="drilldown">cell</option>
<drilldown>
 <set token="units_tok">"TOTO","TITI","TUTU"</set>
</drilldown>

I understand now that i need to have another approch of Splunk ... I will try to variabilize the content for multikv. 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...