Splunk Search

How to get keyvalue pairs listed by clause only when exists?

bollam
Path Finder

I have got multiple events in a log file which contains few key-value pairs and i want to look at only the existence of three key-value pairs (name and location) in all the events.

Name="xyz", age="aa" and location="zzz"

I want to find the percentage of events where "age" does not exist by location and all the "Name" by location

I have following query which gives me the result but not what im expecting.

Key "Name" is being in under location where the event "age" does not exist. The column should be blank under location if "age" does not exist.

Also I need recent five "Name" in which age does not exist.

Sample event:
The name of the person Name="xyz"
The age of the person age="qq"
The location of the person location="www"

index=main
| stats count as Total, count(eval(NOT isnull(age))) as MATCHED count(eval(isnull(age))) as UNMATCHED by location
| eval pctMatched = round(MATCHED/Total*100, 1)
| eval pctUnmatched = round(UNMATCHED/Total*100, 1)
| eval PercentExists = pctMatched + "%"
| eval PercentDoesNotExist = pctUnmatched + "%"
| table cluster percentTagged percentUntagged
| appendcols [ search index=main
| stats count by location, Name
| sort -count
| streamstats count as rank by location | where rank <= 5
| stats list(Name) as Name, list(count) as count by location
| fields - location, count
| table Name ]

Tags (2)
0 Karma

woodcock
Esteemed Legend

Try this:

index=main
| stats count AS Total, count(age) AS MATCHED BY Name location
| eval UNMATCHED = Total - MATCHED
| multireport

[ stats sum(*) AS * BY location
| eval PercentExists = round(100 * MATCHED / Total, 1) + "%"
| eval PercentDoesNotExist = round(100 * UNMATCHED / Total, 1) + "%" ]

[ eval PercentExists = round(100 * MATCHED / Total, 1)
| sort 0 - pctMatched
| dedup 5 location
| eval Top_5_Unmatched_Names = "Name=" . Name . ", Total=" . Total . ", PercentExists=" . PercentExists . "%"
| table Top_5_Unmatched_Names location ]

| stats list(*) AS * BY location
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...