topic Re: how to update table cell results based on another rows sharing common field. in Splunk Search

how to update table cell results based on another rows sharing common field.

AKG1_old1 — Wed, 30 Sep 2020 03:41:47 GMT

Hello,

In search query results some cells populate empty results for specific field. I am looking to update those empty cells based on another row which share same results for another field.

In below table, NICKNAME for some rows are empty. These should be updated same as first 3 rows as they share same NPID and Machine_Name.

NICKNAME = MX (where NPID=43417)
NICKNAME = EPAD_DUPAL_PARALLEL (where NPID=364564)

Thanks

Re: how to update table cell results based on another rows sharing common field.

to4kawa — Mon, 20 Jan 2020 17:51:18 GMT

|sort 0 NPID, NICKNAME, Machine_Name
| filldown

I think that's enough.

Hi, @agoyal Do you have a problem?

| eval NICKNAME = case(isnull(NICKNAME) AND NPID= 43417, "MX" ,isnull(NICKNAME) AND NPID=364564  ,"EPAD_DUPAL_PARALLEL" ,true(),NICKNAME)

this is terrible.

Re: how to update table cell results based on another rows sharing common field.

AKG1_old1 — Mon, 20 Jan 2020 18:22:28 GMT

just using filldown won't work for me. NICKNAME, NPID, Machine_Name are not always having same value.

NPID and Machine name should match before updating the empty NICKNAME.

Attached another example in question.

Re: how to update table cell results based on another rows sharing common field.

to4kawa — Mon, 20 Jan 2020 21:06:03 GMT

I see, my answer is updated. please confirm.

Re: how to update table cell results based on another rows sharing common field.

AKG1_old1 — Wed, 30 Sep 2020 03:42:20 GMT

thanks but as I mentioned before, NPID, NICKNAME, Machine_Name are not same. there could be hundreds of different value.
And 1st solution will fill wrong values without checking the condition of matching NPID and Machine_Name

Re: how to update table cell results based on another rows sharing common field.

to4kawa — Mon, 20 Jan 2020 21:43:28 GMT

but NPID always is.
I do sort .
If NICKNAME is not all Null with any NPID, filldown is OK. beside there are many NICKNAME, Machine_Name, etc.

Anyway, why don't you create NICKNAME.csv and lookup NPID with OUTPUTNEW .

e.g. NICKNAME.csv

NICKNAME,NPID
MX,43417
EPAD_DUPAL_PARALLEL,364564

it's useful.

Re: how to update table cell results based on another rows sharing common field.

AKG1_old1 — Wed, 22 Jan 2020 11:33:41 GMT

| streamstats max(NPID) as NPID_P current=false 
| streamstats max(Machine_Name) as Machine_Name_P current=false 
| streamstats max(NICKNAME) as NICKNAME_P current=false reset_before=("$NPID$!=$NPID_P$") reset_after=("$Machine_Name$!=$Machine_Name_P$") reset_on_change=true 
| eval NICKNAME = if(isnull(NICKNAME) AND NPID=NPID_P AND Machine_Name=Machine_Name_P,NICKNAME_P,NICKNAME)