Search Top Field If exists

[MDClayton]

I'm very new to Splunk, and I'm trying to figure out a way to search by different top fields, depending on whether the first field exists or is not null. Let me try to explain... I have some data that comes in with different severities, and I've created an Extracted Field for an exception_type. The exception_type is only set on rows with a severity of WARN or ERROR.

I'm trying to create a dashboard that I can filter using a dropdown by severity, and it will show a chart of counts of events broken down by exception type. If there are no exception types for that severity, I just want to show an overall count. I started with this, and obviously it doesn't work, but it might give an indication of what I'm trying to do:

severity=$severity$ | eval if(isnotnull(exception_type),top exception_type,stats count as Total) showperc=0

Using "severity=$severity$ | top exception_type showperc=0", and selecting my DD, I get results for WARN and ERROR, but other severities show nothing.

Thanks, I appreciate any help you can give! - Mark

[jeffland · Accepted solution]

Couple of things. First of all, welcome 🙂

Then, eval. You need to specify a field where your eval can put its content, so a typical command looks like

eval check=if(1=1,"world_ok","problems")

which would give you a new field called "check" which should always show you that the world is ok.

Also, you don't use if like you do in a programming language; see here for how it works (it's related to how eval works). If you want different behavior based on the number of results a search has, you'll ned to do that another way, for example in Javascript (since you're on a dashboard). In your case, an easy solution could be to calculate and show both statistics separately (the one about the top exception_type returning nothing to see sometimes).