Splunk Search

Query return value if NULL event

obiwan1129
New Member

I have a query I'm working on where not all the values I feed it are in the index I am querying against.

For example suppose I have two emails, lrhg@gmail.com and charlie.brown@peanuts.com

index=windows sourcetype=ActiveDirectory lrhg@gmail.com OR charlie.brown@peanuts.com | dedup name

Currently only charlie.brown@peanuts.com is in the index. As a result I only return the Event for charlie.brown@peanuts.com.

I'd like to have my query return two records for lrhg@gmail.com and charlie.brown@peanuts.com even if there are no results for lrhg@gmail.com. Something where the event is essentially blank except for the lrhg@gmail.com value

Any thoughts out there?

Tags (2)
0 Karma

DalJeanis
Legend

Use append to add a blank record for each. Look at the makeresults command for one each way to do it.

index=windows sourcetype=ActiveDirectory lrhg@gmail.com OR charlie.brown@peanuts.com 
| append [
    | makeresults 
    | eval name="lrhg@gmail.com charlie.brown@peanuts.com" 
    | makemv name 
    | mvexpand name 
    | table name
    ]
| dedup name
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...