topic How to create couple of values in order to compare both field value in Splunk Search

How to create couple of values in order to compare both field value

cros — Wed, 20 Jan 2021 08:50:51 GMT

Hi,

Here is my raw data :

ID, Version, Date, Status 10874381,1,2020-01-15T08:36:00Z,New 10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed 14688643,1,2016-10-06T06:30:00Z,New 14688643,1,2016-10-07T08:32:00Z,Investigating 14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found

I need to create another field for adding informations to this data. To do that i need to create couple of data.

I can not know in advance how many status could be by id (maybe 1, 2, 7 or more).

I do not know how to create couple with two different event in splunk.

Regards,

Clement

Re: How to create couple of values in order to compare both field value

to4kawa — Wed, 20 Jan 2021 11:11:51 GMT

index=_internal | head 1 | fields _raw | eval _raw="ID, Version, Date, Status 10874381,1,2020-01-15T08:36:00Z,New 10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed 14688643,1,2016-10-06T06:30:00Z,New 14688643,1,2016-10-07T08:32:00Z,Investigating 14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found" | multikv forceheader=1 | table ID, Version, Date, Status | rename COMMENT as "the logic" | streamstats window=2 list(Status) as tmp_status by ID | where mvcount(tmp_status) > 1 | eval Status_1=mvindex(tmp_status,0),Status_2=mvindex(tmp_status,1) | rex field=Status_2 "(?<Result>Completed)" | eval Result=if(isnull(Result),"Work",Result) | table ID Status_* Result | rename ID as Record_number