topic Re: Set attribute for all elements having a certain ID when 2 values are availabe witin the elements having this id in Splunk Search

Set attribute for all elements having a certain ID when 2 values are availabe witin the elements having this id

lukas1 — Mon, 21 Nov 2022 11:16:33 GMT

Hi everyone,

I try to set an attribute to true for all elements having a certain ID, when 2 defined activities are available for that certain ID.

In my optinion the corresponding SQL query would be:

Update t set isvalid = true where id in (select id from t group by id having activity = 'a' and activity = 'b')

A result might look like:

id	activitiy	istrue
001	a	true
001	b	true
001	c	true
002	a	false
002	c	false
002	d	false
003	a	true
003	b	true

Is there an option to execute this in SPL?

Thanks,

Lukas

Re: Set attribute for all elements having a certain ID when 2 values are availabe witin the elements having this id

ITWhisperer — Mon, 21 Nov 2022 13:40:08 GMT

| eventstats values(activity) as activities by id | eval istrue=if(isnotnull(mvfind(activities,"a")) and isnotnull(mvfind(activities,"b")),"true","false")

Re: Set attribute for all elements having a certain ID when 2 values are availabe witin the elements having this id

lukas1 — Mon, 21 Nov 2022 13:55:11 GMT

Thank you @ITWhisperer !

Working now 😀