Splunk Search

How to use fillnull in one sourcetype while using IN

dtccsundar
Path Finder

Hi ,

Like below ,

Sourcetype =Fire

Name                  OS Compare_VersionCompare_Agent Installedsysid
ABC11        windows 10.1   2.2qweq

Sourcetype =Compare

NameOS Fire_VersionFire_Agent Installedsysid
     

 

After doing ,
index=A sourcetype IN (Compare,Fire)

| stats values(*) as * by sysid 
| mvexpand Name
| stats values(*) as * by Name

Since the sourcetype =Compare   has empty row for particular sysid or Name , i am not getting exact output.Its null ,so i need to fill null value="" in the sourcetype which has no rows and the same is required for other scenario too(when sourcetype=Fire has no data and sourcetype =Compare has data).

Please let me know a search which accomodates this too .

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value=""
0 Karma

dtccsundar
Path Finder

Thank you !!

Is there a way to do something like this ,

index=A sourcetype IN (Compare|fillnull value="",Fire)|fillnull value=""

OR 

index=A sourcetype IN (Compare,Fire|fillnull value="")|fillnull value=""

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have no idea what these two searches are trying to achieve, however, do you mean something like this

index=A (sourcetype=Compare AND value="") OR sourcetype=Fire|fillnull value=""
0 Karma

dtccsundar
Path Finder

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search ITAM_Name="*SWZWZQ0001*" OR ITAM_Name="*SADAPP0002*" OR ITAM_Name="*SALINU0016*" OR ITAM_Name="*SGGRNP1002*"

| stats values(*) as * by ITAM_sysid
|eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered")
| table sourcetype ITAM_sysid ITAM_Name F_Agent_Version C_Agent_Version Status

sourcetypeITAM_sysidITAM NameFire Agent VersionCompare Agent VersionStatus

Compare     

Fire

0003fbSALINU0016
32.30.
6.3Not Covered
Compare                    Fire003fcbSGGRNP1002
29.7
 Not Covered
Fire0d456SADAPP000232.3 Covered
Compare0d526SWZWZQ0001  Not Covered

 

Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting "Not covered" instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...