<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Treat two values as the same in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Treat-two-values-as-the-same/m-p/472461#M8072</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I have a scenario that is rare for me and I need help.&lt;/P&gt;
&lt;P&gt;I have had an object receive a change to its ID value, so now it has two IDs that mean the same object. Before, I made a report just including both IDs, but now I need to deliver a report that includes other related objects with their IDs.&lt;/P&gt;
&lt;P&gt;I want to combine the IDs so they appear as a single combined column in the table delivered with the report.&lt;/P&gt;
&lt;P&gt;productID=abc or&lt;BR /&gt;productID=def or&lt;BR /&gt;productID=ghi OR&lt;BR /&gt;productID=jkl OR&lt;BR /&gt;productID=mno&lt;BR /&gt;|chart dc(person) over company by productionID&lt;/P&gt;
&lt;P&gt;Table:&lt;/P&gt;
&lt;P&gt;company abc , def , ghi , jkl , mno&lt;/P&gt;
&lt;P&gt;comp1 1 3 0 5 1&lt;BR /&gt;comp2 2 4 0 0 0&lt;BR /&gt;comp3 0 0 0 0 1 &lt;BR /&gt;comp4 4 0 0 0 1&lt;/P&gt;
&lt;P&gt;I want the output of my table to combine productID, ghi and jkl, so that they only have one productId and it still counts the others individually.&lt;/P&gt;
&lt;P&gt;This is the only case I do this, so I don't need a complicated lookup, I just need it to work for this one table this one time.&lt;/P&gt;</description>
    <pubDate>Mon, 08 Jun 2020 04:25:09 GMT</pubDate>
    <dc:creator>user93</dc:creator>
    <dc:date>2020-06-08T04:25:09Z</dc:date>
    <item>
      <title>Treat two values as the same</title>
      <link>https://community.splunk.com/t5/Reporting/Treat-two-values-as-the-same/m-p/472461#M8072</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I have a scenario that is rare for me and I need help.&lt;/P&gt;
&lt;P&gt;I have had an object receive a change to its ID value, so now it has two IDs that mean the same object. Before, I made a report just including both IDs, but now I need to deliver a report that includes other related objects with their IDs.&lt;/P&gt;
&lt;P&gt;I want to combine the IDs so they appear as a single combined column in the table delivered with the report.&lt;/P&gt;
&lt;P&gt;productID=abc or&lt;BR /&gt;productID=def or&lt;BR /&gt;productID=ghi OR&lt;BR /&gt;productID=jkl OR&lt;BR /&gt;productID=mno&lt;BR /&gt;|chart dc(person) over company by productionID&lt;/P&gt;
&lt;P&gt;Table:&lt;/P&gt;
&lt;P&gt;company abc , def , ghi , jkl , mno&lt;/P&gt;
&lt;P&gt;comp1 1 3 0 5 1&lt;BR /&gt;comp2 2 4 0 0 0&lt;BR /&gt;comp3 0 0 0 0 1 &lt;BR /&gt;comp4 4 0 0 0 1&lt;/P&gt;
&lt;P&gt;I want the output of my table to combine productID, ghi and jkl, so that they only have one productId and it still counts the others individually.&lt;/P&gt;
&lt;P&gt;This is the only case I do this, so I don't need a complicated lookup, I just need it to work for this one table this one time.&lt;/P&gt;</description>
      <pubDate>Mon, 08 Jun 2020 04:25:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Treat-two-values-as-the-same/m-p/472461#M8072</guid>
      <dc:creator>user93</dc:creator>
      <dc:date>2020-06-08T04:25:09Z</dc:date>
    </item>
    <item>
      <title>Re: Treat two values as the same</title>
      <link>https://community.splunk.com/t5/Reporting/Treat-two-values-as-the-same/m-p/472462#M8073</link>
      <description>&lt;P&gt;So if you want to combine productID ghi and jkl together as one, and treat the others individually, try this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;(your search)
| eval prodType=if(productID=="ghi" OR productID=="jkl","combined",productID)
| chart dc(person) AS dcPersonCount over company by prodType
| xyseries company,prodType,dcPersonCount
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 14 Apr 2020 23:19:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Treat-two-values-as-the-same/m-p/472462#M8073</guid>
      <dc:creator>jpolvino</dc:creator>
      <dc:date>2020-04-14T23:19:36Z</dc:date>
    </item>
  </channel>
</rss>

