topic Re: How to consider values of a field from the events of type1 when does not exist in type2? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423670#M121576 <P>Hi,</P> <P>the Answer depends on how exactly your events look like. But in general you can do something with stats to get both fields in one event:</P> <P>your search | | stats list(Success) as l_success by id | eval Success=mvindex(l_success,0)</P> <P>I think to finally answer this question, we need more information about your events.</P> <P>Greetings</P> <P>Tom</P> Tue, 29 Sep 2020 22:18:01 GMT tom_frotscher 2020-09-29T22:18:01Z How to consider values of a field from the events of type1 when does not exist in type2? https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423668#M121574 <P>Hello,</P> <P>I have got two type of events, typeA and typeB, In both the fields I'm interested in only a single field "Success".<BR /> Either if the field Success does not exist or it's value is "" in typeA then it should consider the value of Success from the typeB.<BR /> How do I do this?</P> Wed, 05 Dec 2018 10:12:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423668#M121574 bollam 2018-12-05T10:12:30Z Re: How to consider values of a field from the events of type1 when does not exist in type2? https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423669#M121575 <P>Update:</P> <P>both types will have a common id. If typeA does not contain the "Success" with id "123", It should consider the value of "Success" from typeB which as same id "123"</P> Wed, 05 Dec 2018 10:24:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423669#M121575 bollam 2018-12-05T10:24:19Z Re: How to consider values of a field from the events of type1 when does not exist in type2? https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423670#M121576 <P>Hi,</P> <P>the Answer depends on how exactly your events look like. But in general you can do something with stats to get both fields in one event:</P> <P>your search | | stats list(Success) as l_success by id | eval Success=mvindex(l_success,0)</P> <P>I think to finally answer this question, we need more information about your events.</P> <P>Greetings</P> <P>Tom</P> Tue, 29 Sep 2020 22:18:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423670#M121576 tom_frotscher 2020-09-29T22:18:01Z Re: How to consider values of a field from the events of type1 when does not exist in type2? https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423671#M121577 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/210964">@tom_frotscher</a>, Please find the events and a bit more description on the requirement.</P> <P>I have got events with two different types, Type=First and type=Second</P> <P>I would like to get the consolidated(with unique tags) from both the types based on the following conditions.</P> <P>If both types have a values of tag then on priority it should consider value of tag from the type=First and ignore the tag value from type=Second even if it has value or not.<BR /> ii) If tag has no value i.e., "" in type=First and tag of type=Second has tha value then it consider the value from type=Second for the same id of type=First.<BR /> iii) if both the types has no value in tag. we can ignore this.</P> <P>Note: the values of id_first and id_second has same values but the naming convention is different.</P> <P>time=1544071583425 type="First" version="2.0.5" status="OK" id_first="210468" user="abc" tag="some"<BR /> time=1544071583425 type="First" version="2.0.5" status="OK" id_first="210469" user="xyz" tag=""<BR /> time=1544071583424 type="First" version="2.0.5" status="OK" id_first="210470" user="wow" tag=""<BR /> time=1544071583424 type="First" version="2.0.5" status="OK" id_first="210483" user="rez" <BR /> time=1544071583424 type="First" version="2.0.5" status="OK" id_first="210487" user="yov" tag="wrong"<BR /> time=1544071583424 type="First" version="2.0.5" status="OK" id_first="210491" user="boh" tag=""</P> <P>time=1544071583425 type="Second" version="2.0.5" status="OK" id_second="210468" user="abc" tag="some"<BR /> time=1544071583425 type="Second" version="2.0.5" status="OK" id_second="210469" user="xyz" tag="where"<BR /> time=1544071583424 type="Second" version="2.0.5" status="OK" id_second="210470" user="wow" tag="fishy<BR /> time=1544071583424 type="Second" version="2.0.5" status="OK" id_second="210483" user="rez" <BR /> time=1544071583424 type="Second" version="2.0.5" status="OK" id_second="210487" user="yov" tag="wrong"<BR /> time=1544071583424 type="Second" version="2.0.5" status="OK" id_second="210491" user="boh" tag="great"</P> <P>output:</P> <P>tag id<BR /> some 210469<BR /> where 210469<BR /> fishy 210470<BR /> wrong 210483<BR /> great 210487</P> Tue, 29 Sep 2020 22:18:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-consider-values-of-a-field-from-the-events-of-type1-when/m-p/423671#M121577 bollam 2020-09-29T22:18:15Z