Splunk Search

Simple query to take results and list them as yes/no

mflippin
New Member

Hello. 

I have a large data set that I'm working through that gives either a 5 digit number or a "-" if there is no value. I have my search results but I can't seem to get them into the format I'm looking for. 

I'd like to get the results into a format showing

Room 1 

Set (total)

Unset (total)

And the same for Room 2, 3, 4

 

Query

Index=acme dvc_room="*" station="*" 

Output 

index=acme dvc_room=4 station="-"

index=acme dvc_room=3 station="123456"

index=bluecoat dvc_room=2 station="-"

index=bluecoat dvc_room=1 station="56132"

index=bluecoat dvc_room=3 station="-"

index=bluecoat dvc_room=2 station="56132"

index=bluecoat dvc_room=4 station="56132"

 

Any help would be appreciated. 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You say your query is 

Index=acme dvc_room="*" station="*" 

but you list output with index=bluecoat

Maybe this is what you are after

your search...
| stats sum(eval(if(station="-",0,1))) as Set sum(eval(if(station="-",1,0))) as Unset by dvc_room

Assuming that when you talk about set/unset, you mean that unset is station="-" and set if not.

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...