Splunk Search

How to assign a default value to the count when there are no events?

bollam
Path Finder

I have got five places in the field="location". I want to find if there is no login's happened based on the location.

I need only require the results if there are no events in Splunk from a specific field. For an instance.
If no one has logged in from the location="Hyderabad" and location="Bangalore" then the count should be assigned with a value as "1" by default.

I can get the count if there are events but not from the location where there are no events.

The output should look like below:
location      1
Hyderabad     1
Bangalore     1
Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi bollam,
let me understand: how you can understand when from "Hyderabad" you have only one access (count=1) or no access (count=0)
?
you instead could give the zero value to a location when there isn't any access using an easy way:

  • create a lookup (called e.g. locations.csv) with one column (called e.g. location) containing all the locations;
  • run a search like this:

    index=my_index
    | stats count by location
    | append [ | inputlookup locations.csv | eval count=0 | fields location count ]
    | stats sum(count) AS Total BY location

In this way location with Total=0 aren't accessed.

You can filter locations BY Total and create an alert or display table in graphic mode (see Splunk 7.x Dashboard Examples App).

Bye.
Giuseppe

View solution in original post

gcusello
Legend

Hi bollam,
let me understand: how you can understand when from "Hyderabad" you have only one access (count=1) or no access (count=0)
?
you instead could give the zero value to a location when there isn't any access using an easy way:

  • create a lookup (called e.g. locations.csv) with one column (called e.g. location) containing all the locations;
  • run a search like this:

    index=my_index
    | stats count by location
    | append [ | inputlookup locations.csv | eval count=0 | fields location count ]
    | stats sum(count) AS Total BY location

In this way location with Total=0 aren't accessed.

You can filter locations BY Total and create an alert or display table in graphic mode (see Splunk 7.x Dashboard Examples App).

Bye.
Giuseppe

bollam
Path Finder

Typo in the question.

Output should look like below:

location count
Hyderabad 1
Bangalore 1

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...