Splunk Search

Show an output message, when there were no logs in Splunk while using STATS by

rkmaggidi
New Member

Hi All,

I want to show a message even when there were no results returned in Splunk. While using stats by command.

Below is my query:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by component

and getting results in as shown in below image

alt text

If any of the component is not having logs in Splunk, then it is being ignored from the result set. how should I make sure to include all the components even if there were no logs for them.

Thank you 🙂

0 Karma
1 Solution

to4kawa
Ultra Champion

component.csv:

component
componentA
componentB
....

your query:

 somesearch 
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component

View solution in original post

0 Karma

to4kawa
Ultra Champion

component.csv:

component
componentA
componentB
....

your query:

 somesearch 
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component
0 Karma

rkmaggidi
New Member

Thank you so much. It worked. Can we do this in other way by not using lookups ?

0 Karma

to4kawa
Ultra Champion
....
| fields - Core, Status
| append[| makeresults
| eval component=split("componentA#componentBcomponentC","#")
| mvexpand component
|table component]
 | stats values(*) as * by component

If there is many components, csv is better.

0 Karma

rkmaggidi
New Member

Ok great. Thank you very much 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...