topic Re: How to display result when two fields are dependent in Splunk Cloud Platform

How to display result when two fields are dependent

Splunkerninja — Wed, 29 Nov 2023 12:08:03 GMT

Hi,

I want to display the result only for users who has both ID AR9 & AD. Below is sample data, I have about 10k results being generated with multiple values but i need to display only those users who has ID both AR9 & AD

USER	ID
John	AD
John	AY9
Riya	AD
Toby	AR9
Nathan	AD
Nathan	AR9
Sam	AD
Sam	AR9

Thanks!

Re: How to display result when two fields are dependent

tej57 — Wed, 29 Nov 2023 12:32:21 GMT

Hey @Splunkerninja,

I used makeresults to get a statistical table as provided in the question. You can use the below query to identify a User that has ID to be "AD" and "AR9"

Thanks,
Tejas.

---

If the above solution is helpful, an upvote is appreciated.

Re: How to display result when two fields are dependent

Splunkerninja — Wed, 29 Nov 2023 13:46:32 GMT

@tej57 Thanks but how can i include _time as well in the result since after mvcombine the _time data gets dropped