topic Re: Case condition to check 2 events on the same field in Splunk Search

Case condition to check 2 events on the same field

Ashwini008 — Fri, 10 Mar 2023 06:47:08 GMT

Hi,

I want to write a case condition where i can check values from Range column.

For instance

If range for both cost & product is low the a new column should show value as low

If range for both Cost & Product = severe then New Column should show severe

If range for Cost=severe & Product=low OR if Cost=low & Product =severe Then New column = elevated

Please suggest

Re: Case condition to check 2 events on the same field

PickleRick — Fri, 10 Mar 2023 06:52:00 GMT

What have you tried so far?

Re: Case condition to check 2 events on the same field

Ashwini008 — Fri, 10 Mar 2023 07:43:49 GMT

@PickleRick Tried Case condition with the existing field but only default condition is matching

Also, tried to get results in separate columns yet getting only default condition value i.e. 0

Field name differs in below code

| fillnull value=NA rangecost rangeproduct | eval Valuecombine=case(((rangecost="low" AND Metric="Cost") AND (rangeproduct="low" AND Metric="Product")),"1",((rangecost="severe" AND Metric="Cost") AND (rangeproduct="severe" AND Metric="Product")),"2",((rangecost="low" AND Metric="Cost") AND (rangeproduct="severe" AND Metric="Product")),"3",((rangecost="severe" AND Metric="Cost") AND (rangeproduct="low" AND Metric="Product")),"4",1=1,0) | table Metric Application rangeproduct rangecost Valuecombine

| eval Valuecombine=case(rangeproduct="low" AND rangecost="low","1",rangeproduct="severe" AND rangecost="severe","2",rangeproduct="low" AND rangecost="severe","3",rangeproduct="severe" AND rangecost="low","4",1=1,0)

Re: Case condition to check 2 events on the same field

PickleRick — Fri, 10 Mar 2023 07:56:53 GMT

OK. Different metrics are in separate events so you can't really do a single row eval to match/compare/whatever them. Also the requirement about adding a column where there are two separate rows seems a bit imprecise. Is there an additional field which "groups" the metrics? The Application field? If so, you should first use xyseries to combine different metrics to a single row by that identifier. Then you can use your eval with case or whatever you want.

| xyseries Application Metric range

Re: Case condition to check 2 events on the same field

Ashwini008 — Fri, 10 Mar 2023 08:55:54 GMT

@PickleRick Thanks, But i need the result to be as before i.e. Metric Application range new column and untable isnt working here.

Re: Case condition to check 2 events on the same field

PickleRick — Fri, 10 Mar 2023 09:40:02 GMT

But what meaning would the additional colum have to have if it was "attached" to only one parameter?

You want to have the same value in both rows? Do xyseries and then untable (yes, untable might be tricky if you have multiple columns; you'd need to "pack" and "unpack" them) or do eventstats.