Splunk Search

Reporting on deviceIDs that return no results for a specific search

kyle_ross
New Member

Hello,

I'm trying to write a search query that will return the number of 'IntervalReadingEvent' per deviceID. I've got a full list of my deviceIDs in a lookup but my search will only ever return the count of 'IntervalReadingEvent' for deviceIDs that have at least one of the 'IntervalReadingEvent' results.

Example search:
index="MyIndex" IntervalReadingEvent | lookup MyLookup deviceId OUTPUT MAC_Address | stats count by MAC_Address

That seems to work fine and will return a list of all the MAC_Addresses and the count of how many IntervalReadingEvents they have had. The problem is a MAC_Address must have at least 1 result to show up in my list. I want ALL the MAC_Addresses in my lookup file to be show in the results and show '0' if they have had no IntervalReadingEvents in the last X minutes.

My goal is to find the lack of a particular type of event over X minutes for my list of deviceIDs.

Thank you.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could start with inputlookup, loading all MAC_Addresses - and then join that with your search. Just remember to use a left join with a max other than 1.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...