Splunk Search

How to get list of values which I am not "eval"?

shashank111v
Explorer

Id=xyz

id=ABC

id=EDC

Id=FIS

index=* event=*| eval id = case(id = "xyz" , "one", id = "ABC", "Two")|eval index=case(index="work_prod","PROD",index="work_qa","QA")|table id, index, status |stats count(eval(status ="success")) AS Success, count(eval(status ="failure")) AS Failure BY id, index |rename index as Env, id as Application_name

I am using above query to get Application name and count of failures and success.

Result I am seeing:

Application_name Env Success Failure

one                              Prod  100   2

Two                             QA      20    10

 

I have more than 2 id's but since I am eval only two id's  it is giving only two id's as output. How can I get the rest? 

Expecting result:

Application_name Env Success Failure

one                              Prod  100   2

Two                             QA      20    10

EDC                            QA      20    10

FIS                               PROD      20    10

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval id = case(id = "xyz" , "one", id = "ABC", "Two", true(), id)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval id = case(id = "xyz" , "one", id = "ABC", "Two", true(), id)
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...