Splunk Search

How to replace any multi values found in search result with true and if the value is null replace with No

vinaykataaig
Explorer

Hi there!
I am updating my question:
Below is the scenario where I wanted to see what are the servers got patched since last 3 months. My query pulls up the below table showing server name and patches installed by month and if there is not patched installed for that specific month i did a fill null values to show as "Not Patched". By doing this we just wanted to check if the server is patched for that month or not, we don't need the patch names to be shown.So I wanted to replace all those patch names to some other values like "True"/Patched/yes.

alt text

0 Karma
1 Solution

mayurr98
Super Champion

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]

View solution in original post

0 Karma

mayurr98
Super Champion

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]
0 Karma

vinaykataaig
Explorer

Actually First search worked for me. Thank you!!
And also i thought of doing it another way as well, Just by writing eval logic if the count(Applicable Patch) >"0" then show Patched if the value is null then Not patched.

| replace * WITH "Patched" IN ApplicablePatch
| chart values(ApplicablePatch) as ApplicablePatch by server Month
| fillnull value="Not Patched"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your query? What exactly do you want replaced with "True/Yes"?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinaykataaig
Explorer

Thanks for the response, I have updated my question.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinaykataaig
Explorer

index="oswin" sourcetype="windowsupdatelog" |search "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED"

| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)"
| eval server = Upper(mvindex(split(host,"."),-0))
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval Month = Upper(date_month)
| chart values(ApplicablePatch) as ApplicablePatch by server Month | fillnull value="Not Patched"

0 Karma

mayurr98
Super Champion

I have updated my answer pls try if it doesn't work then could you provide the splunk query to get this result?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...