Splunk Search

How to find the values of a field?

mtrochym
New Member

I am trying to find the total count of nodes in a pool, the total count of bad nodes in the pool AND, that part I am having an issue with, the VALUES of the names of the BAD nodes in the pool.

The below query returns the correct counts for total nodes in the pool and the correct count for total number of bad nodes but I am scratching my head on how to return the values of the NAMES of the bad nodes. All my attempts just return the names of ALL the nodes, when I just want the values of the names of nodes that are bad.

Any thoughts?
Thanks in advance.

| index= ...search blah blah...
| eval StatusOk=if(Status=="passing",1,0) 
| stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
| eval NodeOk = if(countStatusOk=totalCount,1,0) 
| eval NodeBad = if(countStatusOk=totalCount,0,1)
| stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes by server_type, environment 
| where countNodesBad > 0
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

View solution in original post

0 Karma

mtrochym
New Member

That worked! Thank you!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Could you accept my answer for better reference to future visitors?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...