Splunk Search

How to use fillnull in one sourcetype while using IN

dtccsundar
Path Finder

Hi ,

Like below ,

Sourcetype =Fire

Name                  OS Compare_VersionCompare_Agent Installedsysid
ABC11        windows 10.1   2.2qweq

Sourcetype =Compare

NameOS Fire_VersionFire_Agent Installedsysid
     

 

After doing ,
index=A sourcetype IN (Compare,Fire)

| stats values(*) as * by sysid 
| mvexpand Name
| stats values(*) as * by Name

Since the sourcetype =Compare   has empty row for particular sysid or Name , i am not getting exact output.Its null ,so i need to fill null value="" in the sourcetype which has no rows and the same is required for other scenario too(when sourcetype=Fire has no data and sourcetype =Compare has data).

Please let me know a search which accomodates this too .

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value=""
0 Karma

dtccsundar
Path Finder

Thank you !!

Is there a way to do something like this ,

index=A sourcetype IN (Compare|fillnull value="",Fire)|fillnull value=""

OR 

index=A sourcetype IN (Compare,Fire|fillnull value="")|fillnull value=""

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have no idea what these two searches are trying to achieve, however, do you mean something like this

index=A (sourcetype=Compare AND value="") OR sourcetype=Fire|fillnull value=""
0 Karma

dtccsundar
Path Finder

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search ITAM_Name="*SWZWZQ0001*" OR ITAM_Name="*SADAPP0002*" OR ITAM_Name="*SALINU0016*" OR ITAM_Name="*SGGRNP1002*"

| stats values(*) as * by ITAM_sysid
|eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered")
| table sourcetype ITAM_sysid ITAM_Name F_Agent_Version C_Agent_Version Status

sourcetypeITAM_sysidITAM NameFire Agent VersionCompare Agent VersionStatus

Compare     

Fire

0003fbSALINU0016
32.30.
6.3Not Covered
Compare                    Fire003fcbSGGRNP1002
29.7
 Not Covered
Fire0d456SADAPP000232.3 Covered
Compare0d526SWZWZQ0001  Not Covered

 

Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting "Not covered" instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...