Hi,
I'm running Splunk 6.6 and I like to set something like a "default" value in the case that there was nothing found with the SPL query.
The result I get is:
SystemA_primary 4000
SystemA_secondary 100
SystemB_secondary 3000
But I like to get something like this:
SystemA_primary 4000
SystemA_secondary 100
SystemB_primary 0
SystemB_secondary 3000
SystemX_primary 0
SystemX_secondary 0
I tried it with the following querry without success:
index=log 'gateway'
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
| stats count as connections by Inst
| makecontinuous source
| fillnull value=0 connections
Thanks for your tips and answers.
It can not be made unless the value exists.
SystemB、primary
SystemX、primary
SystemX、secondary
Is there a way to get these with LOOKUP etc? Or search all.
Try this!
index=log "gateway" |stats count by source| fields - count
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
|join type=outer Inst
[search index=log "gateway" earliest=-24h@h
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
| stats count as connections by Inst]
| fillnull value=0 connections
※Conditions are different but this one is faster.
| tstats count where index=log by source
I've never used "lookup". With "search all" it should be possible to get alle source files.
Is it maybe possible to use it like seache all sources in the last 24h and set the connection value to "0" for each source and combine the result of lookup and my querry?