×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Lukas972
Engager
Member since: ‎09-16-2021
‎09-17-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-16-2021
View All

Re: How to append text in field on result not foun...

by in Splunk Search
‎09-17-2021 06:03 AM
‎09-17-2021 06:03 AM
Thanks, It work ! That's my new code : <query> index=mysourcelog "successfully" unit IN ($units_tok$) | stats by unit | append [ | makeresults | eval _raw="TOTO TUTU TITI" | multikv noheader=t | rename Column_1 as unit | stats sum(count(linecount)) by unit </query> <option name ="drilldown">cell</option> <drilldown> <set token="units_tok">"TOTO","TITI","TUTU"</set> </drilldown> I understand now that i need to have another approch of Splunk ... I will try to variabilize the content for multikv.  ... View more

How to append text in field on result not found

by in Splunk Search
‎09-16-2021 12:29 PM
‎09-16-2021 12:29 PM
Let's suppose I have TOTO in successfully in my logs. I want to display the result for TOTO and append that no result found for TITI and TUTU with linecount=0 and their name in UNIT. Somebody can help me ?   | search "successfully" | makemv delim="," _raw | table host, unit, linecount | stats count by unit | where unit IN ("TOTO",TITI",TUTU") | append [ ... I'm bugging ... ]   If there is another way to loop on value, I'm open. I didn't found how to declare and use variable exept with token ... ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-17-2021 10:05 AM