Splunk Search

Set zero value if there is nothing found in the search

bosch_softtec
Path Finder

Hi,

I'm running Splunk 6.6 and I like to set something like a "default" value in the case that there was nothing found with the SPL query.

The result I get is:

SystemA_primary       4000
SystemA_secondary      100
SystemB_secondary     3000

But I like to get something like this:

SystemA_primary       4000
SystemA_secondary      100
SystemB_primary          0
SystemB_secondary     3000
SystemX_primary          0
SystemX_secondary        0

I tried it with the following querry without success:

index=log 'gateway'
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
| stats count as connections by Inst
| makecontinuous source
| fillnull value=0 connections

Thanks for your tips and answers.

0 Karma

HiroshiSatoh
Champion

It can not be made unless the value exists.

SystemB、primary
SystemX、primary
SystemX、secondary

Is there a way to get these with LOOKUP etc? Or search all.

Try this!

index=log "gateway" |stats count by source| fields - count
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
|join type=outer Inst
    [search  index=log "gateway" earliest=-24h@h
      | rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
      | eval Inst= Env+"_" + instance
      | stats count as connections by Inst]
 | fillnull value=0 connections

※Conditions are different but this one is faster.
| tstats count where index=log by source

bosch_softtec
Path Finder

I've never used "lookup". With "search all" it should be possible to get alle source files.
Is it maybe possible to use it like seache all sources in the last 24h and set the connection value to "0" for each source and combine the result of lookup and my querry?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...