Splunk Search

EVAL causes a field to be blank

davidcraven02
Communicator

I need the field "Location" added to my search as seen in the screenshot attached. However, in this query below the Location field does not pull through and I have identified that it does work when the | stats values(con_UL) as con_UL by machine line is excluded.

Query below:

index=windows host=*nas* source=WMI:Shares 
| eval machine=lower(host) 
| eval drive = Path 
| rex field=drive "(?P<Drive>\w+)\:" 
| eval con_splunk=machine. "," .Drive 
| eval con_splunkUL = upper(con_splunk) 
| join type=left machine 
    [ search index = varonis source = otl_varonis_monitoring sourcetype="csv" 
    | eval machine = lower(machine) 
    | rex field=Share "((?<drive>\w+)\$)" 
    | eval con=machine. "," .drive 
    | eval con_UL = upper(con) 
    | table machine, Location
    | stats values(con_UL) as con_UL by machine ] 
| eval MonitoringStatus = if(like(upper(con_UL),"%".upper(con_splunkUL)."%"), "Monitored", "Not Monitored") 
| eval Action=if ((MonitoringStatus="Not Monitored")AND(like(Path,"%Hosting%")),"Action Required","No Action Required") 
| dedup machine, Drive, Path, MonitoringStatus 
| table machine, Drive, Path, MonitoringStatus, Action, Location 
| sort +str(type), machine

alt text

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi davidcraven02,
after a stats command you have only the fields of your stats (in your example con_UL and machine), so add to your stats command the value of Location

...
| stats values(con_UL) as con_UL values(Location) AS Location by machine
...

Bye.
Giuseppe

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @davidcraven02,

| stats values(con_UL) as con_UL by machine search part will remove Location field from the search result that's Y it is working if you remove it.

Can you please replace search part and try again ?

SEARCH PART : | stats values(con_UL) as con_UL by machine

NEW : | stats values(con_UL) as con_UL values(Location) as Location by machine

OR | stats values(con_UL) as con_UL by machine,Location

Thanks
Kamlesh

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi davidcraven02,
after a stats command you have only the fields of your stats (in your example con_UL and machine), so add to your stats command the value of Location

...
| stats values(con_UL) as con_UL values(Location) AS Location by machine
...

Bye.
Giuseppe

davidcraven02
Communicator

Brilliant man. Spent all day yesterday trying to get this to work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...