Require Splunk query

khursheed — Tue, 28 Sep 2021 17:50:03 GMT

Below data is dynamic, sample input table is given below, rows are order may vary (for simplicity I have put the data in order to understand easily).

Input:

Feature Name	Browser Name	Result
Feature 1	B1	Pass
Feature 1	B1	Pass
Feature 1	B1	Pass
Feature 1	B1	Pass
Feature 1	B2	Fail
Feature 1	B2	Pass
Feature 1	B2	Pass
Feature 1	B2	Pass
Feature 1	B3	Pass
Feature 1	B3	Pass
Feature 1	B3	Pass
Feature 1	B3	Fail
Feature 1	B4	Pass
Feature 1	B4	Pass
Feature 1	B4	Fail
Feature 1	B4	Pass

Based on the above input table, output needs to be generated as listed below. Cumulative result needs to be generated based on the browser name and result for each feature. If any one of result fails on particular a browser, feature is considered failed.

Output:

Feature 1	B1	Pass
Feature 1	B2	Fail
Feature 1	B3	Fail
Feature 1	B4	Fail

Would you please help me to generate expected output as listed.

Re: Require Splunk query

ITWhisperer — Tue, 28 Sep 2021 18:26:26 GMT

| stats values(Result) as Result by 'Browser Name' 'Feature Name' | eval Result=mvindex(Result,0)

Re: Require Splunk query

somesoni2 — Tue, 28 Sep 2021 19:43:25 GMT

Try something like this

Your Base search fetching fields "Feature Name","Browser Name",Result | stats count(eval(Result="Fail")) as Result by "Feature Name","Browser Name" | eval Result=if(Result>0,"Fail","Pass")

topic Require Splunk query in Splunk Search

Require Splunk query

Re: Require Splunk query

Re: Require Splunk query