Splunk Search
Highlighted

How to find the values of a field?

New Member

I am trying to find the total count of nodes in a pool, the total count of bad nodes in the pool AND, that part I am having an issue with, the VALUES of the names of the BAD nodes in the pool.

The below query returns the correct counts for total nodes in the pool and the correct count for total number of bad nodes but I am scratching my head on how to return the values of the NAMES of the bad nodes. All my attempts just return the names of ALL the nodes, when I just want the values of the names of nodes that are bad.

Any thoughts?
Thanks in advance.

| index= ...search blah blah...
| eval StatusOk=if(Status=="passing",1,0) 
| stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
| eval NodeOk = if(countStatusOk=totalCount,1,0) 
| eval NodeBad = if(countStatusOk=totalCount,0,1)
| stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes by server_type, environment 
| where countNodesBad > 0
0 Karma
Highlighted

Re: How to find the values of a field?

Motivator

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

View solution in original post

0 Karma
Highlighted

Re: How to find the values of a field?

New Member

That worked! Thank you!

0 Karma
Highlighted

Re: How to find the values of a field?

Motivator

Could you accept my answer for better reference to future visitors?

0 Karma