Splunk Enterprise

is it possible to execute code based on a condition?

antonio147
Communicator

Hi all,
I wanted to ask a question: "is it possible to execute code based on a condition"?
example: if A = B then "rename C as D" else "add a column"

My problem:
the where returns columns usually 2, (DIRECT, INDIRECT) but there are some cases that returns 3 (DIRECT, INDIRECT, SPC)
a case that returns only 1 (INDIRECT)
another that returns 1 (DIRECT).
When I do the chart, the third field is called "row 3" (I hope to solve with rename).
When I have only one field (INDIRECT) it is called "row 1" but if I call it "DIRECT" it is not good as the values ​​are from the INDIRECT.
Same thing for the field only (LIVE).
The problem I would like is that the chart always has 2 bars for both DIRECT and INDIRECT, even when there is not one of the two.

with this code I have:
| stats sum (*) by OFFERTA
| transpose
| addtotals fieldname = "TOTAL"
| rename "row 1" as "DIRECT"
| rename "row 2" as "INDIRECT"
| rename "row 3" as "SPC"

Solar year                                            DIRECT     INDIRECT     TOTAL
sum (00_PREVIOUS_MONTH)        8                    4                 12
sum (01_PREVIOUS_MONTH)      32                  16               48
sum (02_PREVIOUS_MONTH)      42                 10               52
sum (03_PREVIOUS_MONTH)      30                  8                38

but if I only have 1 field (INDIRECT)
I have as a result:

Solar Year                                                  DIRECT       TOTAL
sum (00_PREVIOUS_MONTH)              0                   0
sum (01_PREVIOUS_MONTH)              3                  3
sum (02_PREVIOUS_MONTH)              1                  1
sum (03_PREVIOUS_MONTH)               3                 3
sum (04_PREVIOUS_MONTH)               2                  2

 

I would like the chart to have also in this case the two fields with DIRECT and INDIRECT with the DIRECT field all zero

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Have you try to use fillnull before stats for those null values? As you sum those then it shouldn't be a issue if those missing fields have value 0.
r. Ismo
https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Fillnull
0 Karma

antonio147
Communicator

Yes I tried with fillnull but despite the zero values, the field names are wrong.
Maybe I solved it by editing the | command stats sum
Thank you

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...