topic Re: Giving multiple events a field based on one events value in Splunk Search

Giving multiple events a field based on one events value

TooManyQuestion — Wed, 23 Dec 2020 20:53:52 GMT

Hello!

What I'm trying to do is if check if any of the events meet a criteria and if so I want to assign all events a particular field and value.

E.G.
I want to check if any of the RequiredValue field has a value of "Yes". If so all events get the ConditionalValue of "Yes" if not they all get a value of "No"

ID	RequiredValue	ConditionalValue
1	No	Yes
2	No	Yes
3	No	Yes
4	Yes	Yes
5	No	Yes

Any help would be greatly appreciated. Thanks!

Re: Giving multiple events a field based on one events value

to4kawa — Wed, 23 Dec 2020 23:25:39 GMT

| makeresults count=5 | streamstats count as ID | eval RequiredValue=mvindex(split("Yes,No",","),random() % 2) | rename COMMENT as "This is sample. Each time you search, the value changes. From here, the logic." | eventstats count(eval(RequiredValue="Yes")) as ConditionalValue | eval ConditionalValue=if(ConditionalValue > 0,"Yes","No") | table ID RequiredValue ConditionalValue

Re: Giving multiple events a field based on one events value

TooManyQuestion — Thu, 24 Dec 2020 17:56:58 GMT

Thanks so much! Worked like a charm!