https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/609982#M212110 <P><SPAN>You probably need to eval a new field which categorises the services and then filter on those categories. You could use a case function or if functions to do the evaluation, or you could define and use a lookup to map the service to its category.</SPAN></P> Thu, 18 Aug 2022 13:38:02 GMT ITWhisperer 2022-08-18T13:38:02Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/609967#M212105 <P>Hi All,</P> <P>I am new to Splunk and the SPL in general so I will try and explain as best I can.&nbsp; I have been tasked to produce an UP/DOWN dashboard to show different Microsoft Cloud services and their statuses.&nbsp; We are importing data from the Microsoft Service Health and can run searches on it.&nbsp; I am able to find each service (Microsoft Teams, Exchange Online, SharePoint Online etc) and their current status (up or down).&nbsp;</P> <P>Now I need to show this in a dashboard but my manager wants to group the services in categories like, Core services, Productivity and Cloud Apps so that if a person navigates tot he dashboard they can click a dropdown and select the category then those services are displayed&nbsp; with their UP/DOWN status.&nbsp;&nbsp;</P> <P>Any help would be much appreciated.</P> Thu, 18 Aug 2022 12:35:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/609967#M212105 quietferret 2022-08-18T12:35:41Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/609982#M212110 <P><SPAN>You probably need to eval a new field which categorises the services and then filter on those categories. You could use a case function or if functions to do the evaluation, or you could define and use a lookup to map the service to its category.</SPAN></P> Thu, 18 Aug 2022 13:38:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/609982#M212110 ITWhisperer 2022-08-18T13:38:02Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/610010#M212121 <P>Ok so I had the following:</P><P>index=azure source="ServiceAnnouncement.Issues" | sort 0 - _time | eval category = if(service = "Exchange Online" , "Core Service" , other)</P><P>But how can I do multiple if statements?</P> Thu, 18 Aug 2022 16:49:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-groups-values-to-be-used-in-a/m-p/610010#M212121 quietferret 2022-08-18T16:49:46Z