topic How to perform the below condition in Splunk search? in Splunk Search

How to perform the below condition in Splunk search?

dtccsundar — Tue, 08 Nov 2022 15:59:01 GMT

I have 3 date columns.I have already calculated the difference between current day and the diff is in days are the values in the 3 columns.

Col1	Col2	Col3
12		7
2	34	45
15	25
250	56	120
21

Required filter :

- i have to filter only days <=40 in all 3 columns.

- If a column has null and other 2 columns have values <=40 then they need to be shown

-if a column or 2 column has null and rest other column has value <=40 they need to displayed

-if a column is null and other column values are greater >40 then they need to removed from scope.

Please let me know the search .

Re: how to perform the below condition in splunk search

gcusello — Mon, 07 Nov 2022 17:18:54 GMT

HI @dtccsundar,

you have to create a filter like this:

<your search> | fillnull value="-" Col1 | fillnull value="-" Col2 | fillnull value="-" Col3 | search (Col1<=40 Col2<=40 Col3<=40) OR (Col1="-" Col2<=40 Col3<=40) OR (Col1<=40 Col2="-" Col3<=40) OR (Col1<=40 Col2<=40 Col3="-") OR (Col1="-" Col2="-" Col3<=40) OR (Col1="-" Col2<=40 Col3="-") OR (Col1<=40 Col2="-" Col3="-")

Ciao.

Giuseppe

Re: how to perform the below condition in splunk search

dtccsundar — Tue, 08 Nov 2022 06:34:05 GMT

Thank you .

But by using this , the difference in days less than 40 days are also removed .

Kindly help me with this search.

Re: how to perform the below condition in splunk search

gcusello — Tue, 08 Nov 2022 07:41:53 GMT

Hi @dtccsundar,

let me understand: what do you mean with "by using this , the difference in days less than 40 days are also removed "?

I built your all the conditions you described, what are conditions removed?

Ciao.

Giuseppe

Re: how to perform the below condition in splunk search

kamlesh_vaghela — Tue, 08 Nov 2022 08:16:44 GMT

@dtccsundar

Are you looking for this?

YOUR_SEARCH |where (isnull(Col1) OR Col1="" OR Col1>40) OR ((isnull(Col2) OR Col2="" OR Col2>40)) OR (isnull(Col3) OR Col3="" OR Col3>40)

My Sample Search :

| makeresults | eval _raw="Col1 Col2 Col3 12 7 2 34 45 15 25 250 56 120 21 " | multikv forceheader=1 | table Col1 Col2 Col3 | rename comment as "Upto now is for data only" | where (isnull(Col1) OR Col1="" OR Col1>40) OR ((isnull(Col2) OR Col2="" OR Col2>40)) OR (isnull(Col3) OR Col3="" OR Col3>40)