Splunk Search

Include literal dataset in search query / Ensure fixed number of rows in result set

trevorreed
Explorer

Anyone know how to accomplish the Splunk equivalent of the following SQL?

 

SELECT * FROM (SELECT 'dev' AS env, 0 as value UNION SELECT 'beta' as env, 0 as value UNION SELECT 'prod' as env, 0 as value)

 

I intend to combine this arbitrary, literal dataset with another query, but I want to ensure that there are rows for 'dev', 'beta', and 'prod' whether or not Splunk is able to find any records for these environments. The reason for this is, I'm trying to create an alert that will trigger if a particular metric is NOT published often enough in Splunk for each of these environments.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

One way to produce the equivalent to that SQL is with makeresults.

<<your search for env (dev,beta, or prod) and count>>
| append [| makeresults format=csv data="env,count
dev,0
beta,0
prod,0"]
| stats sum(count) as count by env
---
If this reply helps you, Karma would be appreciated.

View solution in original post

trevorreed
Explorer

The makeresults command is exactly what I needed. Thank you!

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

One way to produce the equivalent to that SQL is with makeresults.

<<your search for env (dev,beta, or prod) and count>>
| append [| makeresults format=csv data="env,count
dev,0
beta,0
prod,0"]
| stats sum(count) as count by env
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...