Hi All,
I want to show a message even when there were no results returned in Splunk. While using stats by command.
Below is my query:
somesearch | rex field=msg "ErrorCode\\":(?\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by component
and getting results in as shown in below image
If any of the component is not having logs in Splunk, then it is being ignored from the result set. how should I make sure to include all the components even if there were no logs for them.
Thank you 🙂
component.csv:
component
componentA
componentB
....
your query:
somesearch
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component
component.csv:
component
componentA
componentB
....
your query:
somesearch
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component
Thank you so much. It worked. Can we do this in other way by not using lookups ?
....
| fields - Core, Status
| append[| makeresults
| eval component=split("componentA#componentBcomponentC","#")
| mvexpand component
|table component]
| stats values(*) as * by component
If there is many components, csv is better.
Ok great. Thank you very much 🙂