Splunk Search

how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count )

dtccsundar
Path Finder

I am using below query,


index=A sourcetype IN (Compare,Fire)| fillnull value="" | search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" | stats values(*) as * by sysid |eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") | table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

 

sourcetypeITAM_sysidITAM NameFire Agent VersionCompare Agent VersionStatus

Compare     

Fire

0003fbSALINU0016
32.30.
6.3Not Covered
Compare                    Fire003fcbSGGRNP1002
29.7
 Not Covered
Fire0d456SADAPP000232.3 Covered
Compare0d526SWZWZQ0001  Not Covered

 Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting not covered instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fillnull after the stats

index=A sourcetype IN (Compare,Fire)
| search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" 
| stats values(*) as * by sysid 
| fillnull value="" 
| eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") 
| table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fillnull after the stats

index=A sourcetype IN (Compare,Fire)
| search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" 
| stats values(*) as * by sysid 
| fillnull value="" 
| eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") 
| table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

dtccsundar
Path Finder

This worked Perfectly . Thank You !!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...