Splunk Search

How to replace any multi values found in search result with true and if the value is null replace with No

Explorer

Hi there!
I am updating my question:
Below is the scenario where I wanted to see what are the servers got patched since last 3 months. My query pulls up the below table showing server name and patches installed by month and if there is not patched installed for that specific month i did a fill null values to show as "Not Patched". By doing this we just wanted to check if the server is patched for that month or not, we don't need the patch names to be shown.So I wanted to replace all those patch names to some other values like "True"/Patched/yes.

alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]

View solution in original post

0 Karma

Explorer

Actually First search worked for me. Thank you!!
And also i thought of doing it another way as well, Just by writing eval logic if the count(Applicable Patch) >"0" then show Patched if the value is null then Not patched.

| replace * WITH "Patched" IN ApplicablePatch
| chart values(ApplicablePatch) as ApplicablePatch by server Month
| fillnull value="Not Patched"

0 Karma

SplunkTrust
SplunkTrust

What is your query? What exactly do you want replaced with "True/Yes"?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Thanks for the response, I have updated my question.

0 Karma

SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

index="oswin" sourcetype="windowsupdatelog" |search "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED"

| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)"
| eval server = Upper(mvindex(split(host,"."),-0))
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval Month = Upper(date_month)
| chart values(ApplicablePatch) as ApplicablePatch by server Month | fillnull value="Not Patched"

0 Karma

SplunkTrust
SplunkTrust

I have updated my answer pls try if it doesn't work then could you provide the splunk query to get this result?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!