Splunk Search

how to create a record if missing

jiaqya
Builder

exmaple below

column1:column2
1:10
2:15
4:30
5:40

in this example, column1 is missing "3", i would like to create this record with a "0" value in column2.
how can this be done ?

thanks..

0 Karma

manjunathmeti
Champion

Use append:

<your search> | append [| makeresults | eval column1=3, column2=0]
0 Karma

jiaqya
Builder

this works if record does not exist, at times it ( column1=3) can exist as well..

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...