Splunk Search

Query to compare presence of fields

jt
New Member

Hi everyone,

I am new to splunk and was unsuccessful with my query.
Let's say many events are aggregated in an index from different sourcetype.
I wish to compare the presence of fields in the respective sourcetype.

Example
Sourcetype 1 = gb-req.log
Sourcetype 2 = fr-req.log

My output should look like this

SourcetypeCityemailPhone
fr-req.logyesnoNo
gb-req.logyesyesNo



Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jt,

you could try something like this:

index= your_index (sourcetype=gb-req.log OR sourcetype=fr-req.log)
| fillnull value="No" City
| fillnull value="No" email
| fillnull value="No" Phone
| eval City=if(City="No","No,"Yes"), email=if(email="No","No,"Yes"), Phone=if(Phone="No","No,"Yes")
| stats dc(City) AS dc_city values(City) AS City dc(email) AS dc_email values(email) AS email dc(Phone) AS dc_phone values(Phone) AS Phone BY sourcetype
| eval City=if(dc_city=1,City,"Yes"), email=if(dc_email=1,email,"Yes"), Phone=if(dc_phone=1,Phone,"Yes")

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...