Splunk Search

Show an output message, when there were no logs in Splunk while using STATS by

rkmaggidi
New Member

Hi All,

I want to show a message even when there were no results returned in Splunk. While using stats by command.

Below is my query:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by component

and getting results in as shown in below image

alt text

If any of the component is not having logs in Splunk, then it is being ignored from the result set. how should I make sure to include all the components even if there were no logs for them.

Thank you :slightly_smiling_face:

0 Karma
1 Solution

to4kawa
Ultra Champion

component.csv:

component
componentA
componentB
....

your query:

 somesearch 
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component

View solution in original post

0 Karma

to4kawa
Ultra Champion

component.csv:

component
componentA
componentB
....

your query:

 somesearch 
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component
0 Karma

rkmaggidi
New Member

Thank you so much. It worked. Can we do this in other way by not using lookups ?

0 Karma

to4kawa
Ultra Champion
....
| fields - Core, Status
| append[| makeresults
| eval component=split("componentA#componentBcomponentC","#")
| mvexpand component
|table component]
 | stats values(*) as * by component

If there is many components, csv is better.

0 Karma

rkmaggidi
New Member

Ok great. Thank you very much :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...