Splunk Search

Query to compare presence of fields

jt
New Member

Hi everyone,

I am new to splunk and was unsuccessful with my query.
Let's say many events are aggregated in an index from different sourcetype.
I wish to compare the presence of fields in the respective sourcetype.

Example
Sourcetype 1 = gb-req.log
Sourcetype 2 = fr-req.log

My output should look like this

SourcetypeCityemailPhone
fr-req.logyesnoNo
gb-req.logyesyesNo



Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jt,

you could try something like this:

index= your_index (sourcetype=gb-req.log OR sourcetype=fr-req.log)
| fillnull value="No" City
| fillnull value="No" email
| fillnull value="No" Phone
| eval City=if(City="No","No,"Yes"), email=if(email="No","No,"Yes"), Phone=if(Phone="No","No,"Yes")
| stats dc(City) AS dc_city values(City) AS City dc(email) AS dc_email values(email) AS email dc(Phone) AS dc_phone values(Phone) AS Phone BY sourcetype
| eval City=if(dc_city=1,City,"Yes"), email=if(dc_email=1,email,"Yes"), Phone=if(dc_phone=1,Phone,"Yes")

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!