Splunk Search

count message types by facility

technoe
Explorer

I need to know when a particular facility isn't passing a message type(s). In Powershell it would be as easy as, foreach($facility in $facilities) find message_types...however, sense Splunk doesn't have a foreach command, I'm not sure how to do this. The index contains a field called facility and a field called message_type. Let me know if you need more info.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

<your search providing list of message types (field coming here is message_type)> | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

Query updated to include max=0. try this one. Sample with considering you're using lookup table file.

 | lookup messagetypes.csv | fields message_type | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

View solution in original post

uuppuluri_splun
Splunk Employee
Splunk Employee
0 Karma

technoe
Explorer

That's really close. Unfortunately, it's only returning about 22 results. There should be hundreds.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<your search providing list of message types (field coming here is message_type)> | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

Query updated to include max=0. try this one. Sample with considering you're using lookup table file.

 | lookup messagetypes.csv | fields message_type | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

technoe
Explorer

That is it exactly! Thanks a ton. I've been working on this for a week straight.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

try the updated query.

0 Karma

technoe
Explorer

I have a lookup file containing every file type but I don't know how to compare that to the results of the search.

0 Karma

theouhuios
Motivator

Is there any information in the data which says a particular messsage_type isn't working in a facility? If not, then you might have to use some other methods like Lookup table where you use your existing list with splunk returned results and then compare the values to get the final result.

0 Karma

technoe
Explorer

Let me say this another way. I have a list of known message types and I need to know that each facility is processing each message type over a period of time, if the message type count is 0 I need to know that.

0 Karma

technoe
Explorer

That doesn't show me 0 values though. I need to compare the index to a list of known message types.

0 Karma

theouhuios
Motivator

Please try this |stats count by message_type,facilities

0 Karma

technoe
Explorer

Output should be a list of message_types per facility, including 0 count message_types ie:
message_type facilities count
type1 facility1 1
type2 3
type3 0

type1                      facility2                 2

etc....

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Check splunk's map search command which provides foreach loop. Also, provide sample data/expected output.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...