Splunk Search

How to group by forcing line value

matimat
Explorer

Hi,

I want to show how many lines contains some value even if no line return.

My data :

Row 1 :
F1: a
Row 2 :
F1: b

Result desired on table :
F1 => Nb
a => 1
b => 1
c => 0

Tags (3)
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults
| eval host="All real events will have a 'host' value"
| eval F1="a b"
| makemv F1
| mvexpand F1

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| append [|makeresults
| rename COMMENT AS "This would better be done using a 'lookup' file with ' |inputlookup append=t' instead of '|makeresults ...'"
| eval F1="a b c d e f list all possible values here"
| makemv F1 ]
| stats count(host) AS Nb BY F1

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults
| eval host="All real events will have a 'host' value"
| eval F1="a b"
| makemv F1
| mvexpand F1

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| append [|makeresults
| rename COMMENT AS "This would better be done using a 'lookup' file with ' |inputlookup append=t' instead of '|makeresults ...'"
| eval F1="a b c d e f list all possible values here"
| makemv F1 ]
| stats count(host) AS Nb BY F1

matimat
Explorer

Thanks your solution works. I add this :

|append [| makeresults | eval F1 ="a b c" | makemv F1] | stats count(host) as Nb BY F1

0 Karma

nplamondon
Communicator

@woodcock answered a very similar question a while back. Check out https://answers.splunk.com/answers/566928/how-to-find-missing-values-from-a-search-events-co-1.html

arjunpkishore5
Motivator

Do you have a master list of all possible values for F1? If yes, is it in a lookup file?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...