Splunk Search

How to create a table with a static column A and dynamic column B based on search values?

priyenshah6
Engager

I want to create a table as:

Column A, Column B
LoginFailure, YES
LoginSuccess, NO
Account Lockout, YES

Basically YES/NO values are determined depending on if that event occurred.

My challenge is if LoginSuccess event never occurred, it does not get displayed in my report. So I need a report with static number of rows (which will be predefined list of events I want to monitor) and values as Yes/No depending if that event occurred for a given timeframe.

0 Karma

ppablo
Retired

Hi @priyenshah6

Just following up with this question, but did @somesoni2's answer below help solve your question?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your search producing columnA and ColumnB | append [| gentimes start=-1 | eval columnA="LoginFailure,LoginSuccess,Account Lockout" | table columnA | makemv delim="," columnA | mvexpand columnA] | stats values(columnB) as columnB by columnA | fillnull value="NO" columnB
0 Karma

priyenshah6
Engager

Thanks @somesoni2 for your response. I used Lookup approach to resolve the issue. Figured it was easy to manage Lookup file. Here is how I did it:

| inputlookups Events.csv | eval count=0 | append [search xyz [inputlookup Events.csv] | stats count by name] | stats sum(count) as total by name | eval status=if(total>0,"Yes","No")

here my Lookup file has list of all event names that I want to monitor and need status as Yes/No depending if they occurred in given time frame.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...