Repeating fields

klaudiac — Fri, 11 Dec 2020 14:34:02 GMT

Hi guys,

I'm looking to add a new column to my inputlookup.

The idea is to mark the values that repeat e.g.:

Email Threat Attachment Delivered	Analytics
Voice mail spam	Network
Jira Heartbeat	N/A
Voice mail spam	Network

And do something like this:

Name	Zone	Repeats
Email Threat Attachment Delivered	Analytics	No
Voice mail spam	Network	Yes
Jira Heartbeat	N/A	No
Voice mail spam	Network	Yes

I know I can just do a | stats count by Name, but that doesn't solve my problem.

Any hints on how to solve it would be greatly appreciated 🙂

Re: Repeating fields

richgalloway — Fri, 11 Dec 2020 15:59:24 GMT

Why does stats not solve your problem? Have you tried eventstats?

| makeresults | eval _raw="Name Zone Email Threat Attachment Delivered Analytics Voice mail spam Network Jira Heartbeat N/A Voice mail spam Network" | multikv forceheader=1 ```Above just sets up test data``` | eventstats count as Repeats by Name,Zone | eval Repeats=if(Repeats=1,"No", "Yes") | table Name Zone Repeats

topic Re: Repeating fields in Splunk Search

Repeating fields

Re: Repeating fields