topic How can i filter columns based on other column value in Knowledge Management

How can i filter columns based on other column value

jvishwak — Tue, 29 Sep 2020 11:15:40 GMT

Hi,

I have a created a table with columns A and B, we are using KV store to get the threshold config data and KV
Store in response providing table column names as
...
KV Store is also having a column (component_id) value of which is same as column A in other table.

I want to filter the KV Store's column .. based on the value of column B and column A.

I tried using a macro with 2 parameters in first input passing the column A value and other parameter passing column B value.

But its not working, macro is not searching the desired result, also it is overwriting previous table fields.

Can someone help on the possible ways to get the required result from the KV store.

Re: How can i filter columns based on other column value

msivill_splunk — Mon, 03 Oct 2016 08:01:32 GMT

So heres a simpler example of filtering by lookup value which should hopefully get you started.

Using data ( put into index 456446 ) -

time,column_a,column_b
09-21-2016 01:00:00,11,10
09-22-2016 01:00:00,9,10
09-23-2016 01:00:00,7,10
09-24-2016 01:00:00,5,10
09-25-2016 01:00:00,3,10
09-26-2016 01:00:00,1,10
09-27-2016 01:00:00,0,10

With lookup ( put into 456446_lookup ) -

component_id, value
1,1
2,2
3,3
4,5
5,8
6,13
7,21
8,34
9,55
10,89

You can use this -

index="456446" 
| lookup 456446_lookup component_id as column_a outputnew value as comparison_field
| table column_a, column_b, comparison_field
| where column_b < comparison_field

Re: How can i filter columns based on other column value

jvishwak — Tue, 29 Sep 2020 11:15:45 GMT

updating he question as few text got removed while pasting...
KV Store in response providing table column names as
..

Re: How can i filter columns based on other column value

jvishwak — Tue, 29 Sep 2020 11:15:48 GMT

Somehow the text is getting removed :(, in simple format again

KV Store in response providing table column names as
someFixedtext.ValueAsWeHaveInColumnB.SomeFixedText