I have got five places in the field="location". I want to find if there is no login's happened based on the location.
I need only require the results if there are no events in Splunk from a specific field. For an instance.
If no one has logged in from the location="Hyderabad" and location="Bangalore" then the count should be assigned with a value as "1" by default.
I can get the count if there are events but not from the location where there are no events.
The output should look like below:
location 1
Hyderabad 1
Bangalore 1
Hi bollam,
let me understand: how you can understand when from "Hyderabad" you have only one access (count=1) or no access (count=0)
?
you instead could give the zero value to a location when there isn't any access using an easy way:
run a search like this:
index=my_index
| stats count by location
| append [ | inputlookup locations.csv | eval count=0 | fields location count ]
| stats sum(count) AS Total BY location
In this way location with Total=0 aren't accessed.
You can filter locations BY Total and create an alert or display table in graphic mode (see Splunk 7.x Dashboard Examples App).
Bye.
Giuseppe
Hi bollam,
let me understand: how you can understand when from "Hyderabad" you have only one access (count=1) or no access (count=0)
?
you instead could give the zero value to a location when there isn't any access using an easy way:
run a search like this:
index=my_index
| stats count by location
| append [ | inputlookup locations.csv | eval count=0 | fields location count ]
| stats sum(count) AS Total BY location
In this way location with Total=0 aren't accessed.
You can filter locations BY Total and create an alert or display table in graphic mode (see Splunk 7.x Dashboard Examples App).
Bye.
Giuseppe
Typo in the question.
Output should look like below:
location count
Hyderabad 1
Bangalore 1