Splunk Search

How to find the values of a field?

mtrochym
New Member

I am trying to find the total count of nodes in a pool, the total count of bad nodes in the pool AND, that part I am having an issue with, the VALUES of the names of the BAD nodes in the pool.

The below query returns the correct counts for total nodes in the pool and the correct count for total number of bad nodes but I am scratching my head on how to return the values of the NAMES of the bad nodes. All my attempts just return the names of ALL the nodes, when I just want the values of the names of nodes that are bad.

Any thoughts?
Thanks in advance.

| index= ...search blah blah...
| eval StatusOk=if(Status=="passing",1,0) 
| stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
| eval NodeOk = if(countStatusOk=totalCount,1,0) 
| eval NodeBad = if(countStatusOk=totalCount,0,1)
| stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes by server_type, environment 
| where countNodesBad > 0
0 Karma
1 Solution

VatsalJagani
Champion

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

View solution in original post

0 Karma

mtrochym
New Member

That worked! Thank you!

0 Karma

VatsalJagani
Champion

Could you accept my answer for better reference to future visitors?

0 Karma

VatsalJagani
Champion

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...