About Skysurfer

Skysurfer · ‎04-17-2023

I have a query that I am using to get the count of events index=system source=/var/log/syslog/* | rex field=source "(?<host_name>[^\"]*)" | stats count by host_name Now have a lookup file hf_lookup.csv where there is column as hf_name. This hf_name is the host_name from the above query. I want to get the count against each value of hf_name. Even if the count is 0 for a hf_name, it should be displayed as 0. Tried using inputlookup with left join and "fillnull value=0 count" but either I am only getting count=>1 or for the hosts that are not in hf_lookup.csv.

Skysurfer · ‎09-11-2022

@gcusello @Thank you, it worked. Shouldn’t have put it as count as count itself has a different meaning in splunk. It was actually a field value that I was getting by doing some stats sum. Ciao

Skysurfer · ‎09-11-2022

Can someone please help me with this. I have looking for a query so that if count is less than 0 change it to 0, otherwise display actual count. for example, if the count is -23, the result should be count=0 and if the count is 23, the result should be count=23.

Skysurfer · ‎07-19-2022

Thanks a lot @gcusello . It worked 😁

Skysurfer · ‎07-15-2022

Hi @gcusello Here "User!=Account | table User Account" would give something like this. As you can see all values are different. so dedup will not help. User Account p12345 redfox p12345 h12345 p12345 home\redfox p12345 new@redfox.com I am looking for something where there is no value in Account field for the User. Ciao

Skysurfer · ‎07-15-2022

Hi @gcusello Thank you for your response. I tried using mvexpand, but using User!=Account gives 4 matches for "Sample 1" and 3 matches for "Sample 2". What I am looking for is only one output where there will be no corresponding value in account field. In the above two samples "| table User" should only give output as User P12345

Skysurfer · ‎07-15-2022

I have a data with two fields: User and Account Account is a field with multiple values. I am looking for a search that shows all the results where User is NOT matching any of the values in Account. From the below mentioned sample data, the search should only give "Sample 1" as output Sample 1 User Account p12345 redfox h12345 home\redfox new@redfox.com Sample 2 User Account L12345 redsox L12345 sky\newid sam@redsox.com I have tried makemv, but not getting desired output

Posts	7
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎07-14-2022

Online Status	Offline
Date Last Visited	‎04-17-2023 02:20 PM

How to count for all hosts from lookup?

How to achieve search that If count is less than 0...

How to match field values with multivalue field?

How to count for all hosts from lookup?

Re: If count less than 0 make it 0

How to achieve search that If count is less than 0...

Re: match field values with multivalue field

Re: match field values with multivalue field

Re: match field values with multivalue field

How to match field values with multivalue field?

Join the Conversation