Splunk Search

Why am I getting where clause?

hantun
Loves-to-Learn Lots

I have a search where I am comparing two indexes for a matching cell and I am trying to filter where Business = 1X... here's the SPL:

index=csmp OR index=aws-business-map
| eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName)
| stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) by BindleNew
| search AWSAccountName!=""

I am unsure where to put Business-="1X" clause. 

Also, if we have more indexes like csmp that I am trying to compare to aws-business-map, how do we go about matching 4 indexes to aws-business-map?

Labels (2)
0 Karma

hantun
Loves-to-Learn Lots

Can we put that into a static function of a dropdown? If so, how should we go about it? 

I am building dashboard where we are counting the business

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Static values are pre-defined and cannot use search results.  It's the dynamic dropdowns that use searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should answer the question

index=csmp OR index=aws-business-map
| eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName)
| stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) as Business by BindleNew
| search AWSAccountName!="" Business-="1X"

To add more indexes

index=csmp OR index=aws-business-map OR index=index3 OR index=index4
| eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName, sourcetype="st3", foo, sourcetype="st4", bar)
| stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) as Business by BindleNew
| search AWSAccountName!="" Business-="1X"

I believe it will not solve the problem, however.  That's because the values function returns a multi-value field that doesn't work well with many other commands.  Multi-value fields need to be processed with mv* functions (mvindex, mvfind, etc).

---
If this reply helps you, Karma would be appreciated.
0 Karma

hantun
Loves-to-Learn Lots

index=csmp OR index=aws-business-map OR index=sim OR index=guardduty
| eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName, sourcetype="sim_prod", WAWT2-BindleName, sourcetype="sim_prod", CloudTrail-AWSAccountName, sourcetype="sim_gd", AWSAccountId)
| stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(WAWT2-BindleName), values(CloudTrail-AWSAccountName), values(AWSAccountId), values(Business) as Business by BindleNew
| search AWSAccountName!="" Business="XP"

This is what I have for combination so far. Something to note is that CloudTrail-AWSAccountName, WAWT2-BindleName, BindleName, AWSAccountName are all the same data. Can we normalize them using Match?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If those fields are all the same then there's no need for a case function.  Use the coalesce function to choose the first field that is present in the current event.

index=csmp OR index=aws-business-map OR index=sim OR index=guardduty
| eval BindleNew = lower(coalesce(AWSAccountName, BindleName, WAWT2-BindleName, CloudTrail-AWSAccountName, AWSAccountId))
| stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(WAWT2-BindleName), values(CloudTrail-AWSAccountName), values(AWSAccountId), values(Business) as Business by BindleNew
| search AWSAccountName!="" Business="XP"

 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

hantun
Loves-to-Learn Lots

How can we put that SPL query into a dynamic dropdown?

My project is looking for if the query spits out 1X, splunk gets all the events with the Business as 1X. If query is looking for 2X, gets all the events with Business as 2X. Then, I have dashboard panels that are doing counts etc depending on the dropdown.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Edit the dashboard and click on the edit icon for the dropdown.  Put the query into the search box in the Dynamic Options section.

richgalloway_0-1682629922266.png

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...