Splunk Search

How to find the values of a field?

mtrochym
Observer

I am trying to find the total count of nodes in a pool, the total count of bad nodes in the pool AND, that part I am having an issue with, the VALUES of the names of the BAD nodes in the pool.

The below query returns the correct counts for total nodes in the pool and the correct count for total number of bad nodes but I am scratching my head on how to return the values of the NAMES of the bad nodes. All my attempts just return the names of ALL the nodes, when I just want the values of the names of nodes that are bad.

Any thoughts?
Thanks in advance.

| index= ...search blah blah...
| eval StatusOk=if(Status=="passing",1,0) 
| stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
| eval NodeOk = if(countStatusOk=totalCount,1,0) 
| eval NodeBad = if(countStatusOk=totalCount,0,1)
| stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes by server_type, environment 
| where countNodesBad > 0
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

View solution in original post

0 Karma

mtrochym
Observer

That worked! Thank you!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Could you accept my answer for better reference to future visitors?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...