Splunk Search

Showing table despite no result

k31453
Explorer

Hi, I have base search which has appname field which lists all apps I have on splunk instance. I would like to output table or static in which it says whether apps a,b,c,d are present. If it is what it is version and what indexers are installed at. If there is no result found in base search, i would still like to see output as all a-d apps as absent status.

I already have base search :

 

index=.. host=... AND appname IN (a,b,c,d) 

 

k31453_0-1598417543439.png

 

Tags (3)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust

index=.. host=... AND appname IN (a,b,c,d) | append [|makeresults | eval appname=split("abcd","") |mvexpand appname | table appname] | dedup appname |table appname status version indexers |fillnull status value="Absent"

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

index=.. host=... AND appname IN (a,b,c,d) | append [|makeresults | eval appname=split("abcd","") |mvexpand appname | table appname] | dedup appname |table appname status version indexers |fillnull status value="Absent"

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
0 Karma

k31453
Explorer

This is not much helping as this is bit odd case. 

0 Karma