topic Re: Eval field based on multiple fields? in Splunk Search

Eval field based on multiple fields?

matstap — Mon, 16 Apr 2018 15:57:28 GMT

I have three fields A, B, C. I want to evaluate a field D that has the value of C that corresponds with the min value of B when 0 < B < 4, and A=1. How do I evaluate D? Can I use an eval statement in stats?

Example: if I have the given records with the same ID field,

A=1,B=6,C=2
A=1,B=2,C=3
A=1,B=1,C=5,

Then D=5

Re: Eval field based on multiple fields?

elliotproebstel — Mon, 16 Apr 2018 16:15:22 GMT

I don't quite understand your description. It sounds like you want D=C if 0<B<4 and A=1. But this is true in both of the following lines:

A=1,B=2,C=3
A=1,B=1,C=5

So I don't understand how you've determined that D=5 and not D=3. Can you explain?

Re: Eval field based on multiple fields?

matstap — Mon, 16 Apr 2018 16:20:32 GMT

I meant to write the min value of B when 0 < B < 4.

Re: Eval field based on multiple fields?

elliotproebstel — Mon, 16 Apr 2018 16:22:49 GMT

Given your clarification, I think this should do it (assuming the ID field you mentioned is in a field called unique_id😞

your base search
| eventstats min(B) AS min_B BY unique_id
| eval D=if(B=min_B AND 0<B AND B<4 AND A=1, C, NULL)

Re: Eval field based on multiple fields?

matstap — Tue, 17 Apr 2018 17:23:48 GMT

I forgot about eventstats. Thanks