I have a bar graph that charts two values. When one of the values is 0, the graph removes the column altogether. This makes it difficult to ascertain that two values are being compared. How can I keep a placeholder for a 0 value in the graph with the field name intact?
Thanks
This is the Sentinel Search
problem discussed (with solution) here:
https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf
This is the Sentinel Search
problem discussed (with solution) here:
https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf
Thanks. However I'm having a bit of trouble with the sentinel value implementation (found on pages 25-27).
index=myIndex AND sourcetype=mySource AND ("string1" OR "string2") | eval split=if(match(_raw, ".*string1*."), "Requests", "Timeouts") | inputlookup append=true Timeouts | chart count by split
The above query returns 'The lookup table Timeouts is invalid'. What am I missing?
If you are creating an ad-hoc lookup, you must use Timeouts.csv
. When you specify a lookup without .csv
on the end, Splunk looks for a Lookup definition
named, in this case, Timeouts
, to see if it is a Lookup file
or a KV Store
. It does not find such and gives you this error. The other way around it is to create a lookup definition calledTimeouts
that is file-based as Timeouts.csv
.
Don't forget to click Accept
to close the question.