Thanks @bowesmana for the suggestions. Can you please let me know how i can use the lookup with the below search. Below query gives me the results of all the columns if there is a record in th...
See more...
Thanks @bowesmana for the suggestions. Can you please let me know how i can use the lookup with the below search. Below query gives me the results of all the columns if there is a record in the splunk logs with JOBNAME values as A1 and A2. If there is no record for the jobname A1 and A2, there is no record fetched, and output is blank. index = main source=xyz (TERM(A1) OR TERM(A2) ) ("- ENDED" OR "- STARTED" ) | rex field=TEXT "((A1-) |(A2-) )(?<Func>[^\-]+)" | eval Function=trim(Func), DAT = strftime(relative_time(_time, "+0h"), "%d/%m/%Y") | rename DAT as Date_of_reception | eval {Function}_TIME=_time | stats values(Date_of_reception) as Date_of_reception values(*_TIME) as *_TIME by JOBNAME | table JOBNAME,Description, Date_of_reception ,STARTED_TIME , ENDED_TIME | sort -STARTED_TIME We want the output as below even when there is no record in the splunk logs with column1 values as A1 and A2. When there is no record, fields "Date_of_reception ,STARTED_TIME , ENDED_TIME " should be Blank. File.csv : JOBNAME ,Description A1 , Job A1 A2, Job A2 Desired Output : JOBNAME,Description, Date_of_reception ,STARTED_TIME , ENDED_TIME A1 , Job A1 , 05/02/2025 , 12:54:31 , 12:54:40 A2, Job A2 , , , Date_of_reception ,STARTED_TIME , ENDED_TIME is blank for A2 because there are no logs in Splunk for the Jobname A2. Can you please help to update the query to get the desired output: Current query: index = main source=xyz (TERM(A1) OR TERM(A2) ) ("- ENDED" OR "- STARTED" ) | rex field=TEXT "((A1-) |(A2-) )(?<Func>[^\-]+)" | eval Function=trim(Func), DAT = strftime(relative_time(_time, "+0h"), "%d/%m/%Y") | rename DAT as Date_of_reception | eval {Function}_TIME=_time | stats values(Date_of_reception) as Date_of_reception values(*_TIME) as *_TIME by JOBNAME | table JOBNAME,Description, Date_of_reception ,STARTED_TIME , ENDED_TIME | sort -STARTED_TIME