Splunk Search

count message types by facility

technoe
Explorer

I need to know when a particular facility isn't passing a message type(s). In Powershell it would be as easy as, foreach($facility in $facilities) find message_types...however, sense Splunk doesn't have a foreach command, I'm not sure how to do this. The index contains a field called facility and a field called message_type. Let me know if you need more info.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

<your search providing list of message types (field coming here is message_type)> | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

Query updated to include max=0. try this one. Sample with considering you're using lookup table file.

 | lookup messagetypes.csv | fields message_type | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

View solution in original post

uuppuluri_splun
Splunk Employee
Splunk Employee
0 Karma

technoe
Explorer

That's really close. Unfortunately, it's only returning about 22 results. There should be hundreds.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<your search providing list of message types (field coming here is message_type)> | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

Query updated to include max=0. try this one. Sample with considering you're using lookup table file.

 | lookup messagetypes.csv | fields message_type | join type=left max=0 message_type [search <your base search> | stats count by message_type, facilities] | fillnull count

technoe
Explorer

That is it exactly! Thanks a ton. I've been working on this for a week straight.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

try the updated query.

0 Karma

technoe
Explorer

I have a lookup file containing every file type but I don't know how to compare that to the results of the search.

0 Karma

theouhuios
Motivator

Is there any information in the data which says a particular messsage_type isn't working in a facility? If not, then you might have to use some other methods like Lookup table where you use your existing list with splunk returned results and then compare the values to get the final result.

0 Karma

technoe
Explorer

Let me say this another way. I have a list of known message types and I need to know that each facility is processing each message type over a period of time, if the message type count is 0 I need to know that.

0 Karma

technoe
Explorer

That doesn't show me 0 values though. I need to compare the index to a list of known message types.

0 Karma

theouhuios
Motivator

Please try this |stats count by message_type,facilities

0 Karma

technoe
Explorer

Output should be a list of message_types per facility, including 0 count message_types ie:
message_type facilities count
type1 facility1 1
type2 3
type3 0

type1                      facility2                 2

etc....

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Check splunk's map search command which provides foreach loop. Also, provide sample data/expected output.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...