Splunk Search

How to use fillnull in one sourcetype while using IN

dtccsundar
Path Finder

Hi ,

Like below ,

Sourcetype =Fire

Name                  OS Compare_VersionCompare_Agent Installedsysid
ABC11        windows 10.1   2.2qweq

Sourcetype =Compare

NameOS Fire_VersionFire_Agent Installedsysid
     

 

After doing ,
index=A sourcetype IN (Compare,Fire)

| stats values(*) as * by sysid 
| mvexpand Name
| stats values(*) as * by Name

Since the sourcetype =Compare   has empty row for particular sysid or Name , i am not getting exact output.Its null ,so i need to fill null value="" in the sourcetype which has no rows and the same is required for other scenario too(when sourcetype=Fire has no data and sourcetype =Compare has data).

Please let me know a search which accomodates this too .

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value=""
0 Karma

dtccsundar
Path Finder

Thank you !!

Is there a way to do something like this ,

index=A sourcetype IN (Compare|fillnull value="",Fire)|fillnull value=""

OR 

index=A sourcetype IN (Compare,Fire|fillnull value="")|fillnull value=""

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have no idea what these two searches are trying to achieve, however, do you mean something like this

index=A (sourcetype=Compare AND value="") OR sourcetype=Fire|fillnull value=""
0 Karma

dtccsundar
Path Finder

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search ITAM_Name="*SWZWZQ0001*" OR ITAM_Name="*SADAPP0002*" OR ITAM_Name="*SALINU0016*" OR ITAM_Name="*SGGRNP1002*"

| stats values(*) as * by ITAM_sysid
|eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered")
| table sourcetype ITAM_sysid ITAM_Name F_Agent_Version C_Agent_Version Status

sourcetypeITAM_sysidITAM NameFire Agent VersionCompare Agent VersionStatus

Compare     

Fire

0003fbSALINU0016
32.30.
6.3Not Covered
Compare                    Fire003fcbSGGRNP1002
29.7
 Not Covered
Fire0d456SADAPP000232.3 Covered
Compare0d526SWZWZQ0001  Not Covered

 

Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting "Not covered" instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...