Splunk Search

How to use predicate expression in search?

Julia1231
Communicator

Hi everybody,
My data is: A = 10, B= 20, C = 30.
the fomular that I use is: result = A/(B+C) but I have to verify, the result only displays when 3 values exist, if not (one of them or 3 of them are null), it displays as "--".

here is my command:

|eval Result= case(isnotnull(A) AND isnotnull(B) AND isnotnull(C) ,round(A/(B+ C)),1=1, "--")

For now, if one of them is null, it displays "--" but when 3 of them are null, it show the text "No result".

How can I show it llike "--" for the 2 cases: 1 of them or 3 of them are null, it always show "--"

THANKS

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk works on events in an event pipeline - if all 3 are null, it probably means there are no events in the pipeline?

Assuming this to be the case, you can use appendpipe to create an event, something like this:

| appendpipe [ stats _count | where _count = 0 | eval Result="--"]

 

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...