topic Re: How to table results with multiple evals? in Splunk Search

How to table results with multiple evals?

aohls — Wed, 08 Mar 2023 20:43:55 GMT

I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like:

Search	Triggered	Scheduled	Test
TestAlert1	True	True	True

Currently what I am getting is something like this:

I am thinking I need to use xyseries chart but am not sure.

bowesmana — Wed, 08 Mar 2023 22:19:06 GMT

I assume that you are saying that if a search has True anywhere, then it's True, otherwise false.

You could do something like

| stats values(*) as * by Search | foreach * [ eval <<FIELD>>=if(isnotnull(mvfind(<<FIELD>>, "True")), "True", "False") ]

but you could also set values to 1 and 0 for True/False and then do

| stats max(*) as * by Search | foreach Triggered Scheduled Test [ eval <<FIELD>>=if(<<FIELD>>=1, "True", "False") ]