Splunk Search

Simple query to take results and list them as yes/no

mflippin
New Member

Hello. 

I have a large data set that I'm working through that gives either a 5 digit number or a "-" if there is no value. I have my search results but I can't seem to get them into the format I'm looking for. 

I'd like to get the results into a format showing

Room 1 

Set (total)

Unset (total)

And the same for Room 2, 3, 4

 

Query

Index=acme dvc_room="*" station="*" 

Output 

index=acme dvc_room=4 station="-"

index=acme dvc_room=3 station="123456"

index=bluecoat dvc_room=2 station="-"

index=bluecoat dvc_room=1 station="56132"

index=bluecoat dvc_room=3 station="-"

index=bluecoat dvc_room=2 station="56132"

index=bluecoat dvc_room=4 station="56132"

 

Any help would be appreciated. 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You say your query is 

Index=acme dvc_room="*" station="*" 

but you list output with index=bluecoat

Maybe this is what you are after

your search...
| stats sum(eval(if(station="-",0,1))) as Set sum(eval(if(station="-",1,0))) as Unset by dvc_room

Assuming that when you talk about set/unset, you mean that unset is station="-" and set if not.

 

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...