Splunk Search

How to get list of values which I am not "eval"?

shashank111v
Explorer

Id=xyz

id=ABC

id=EDC

Id=FIS

index=* event=*| eval id = case(id = "xyz" , "one", id = "ABC", "Two")|eval index=case(index="work_prod","PROD",index="work_qa","QA")|table id, index, status |stats count(eval(status ="success")) AS Success, count(eval(status ="failure")) AS Failure BY id, index |rename index as Env, id as Application_name

I am using above query to get Application name and count of failures and success.

Result I am seeing:

Application_name Env Success Failure

one                              Prod  100   2

Two                             QA      20    10

 

I have more than 2 id's but since I am eval only two id's  it is giving only two id's as output. How can I get the rest? 

Expecting result:

Application_name Env Success Failure

one                              Prod  100   2

Two                             QA      20    10

EDC                            QA      20    10

FIS                               PROD      20    10

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval id = case(id = "xyz" , "one", id = "ABC", "Two", true(), id)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval id = case(id = "xyz" , "one", id = "ABC", "Two", true(), id)
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...