topic Re: How to display a single error in multiple inputs? in Splunk Search

How to display a single error in multiple inputs?

Dayalss — Tue, 13 Jun 2023 11:57:32 GMT

Hi ,

I have a search query -

| search Region = EMEA
| eval Status=case(Statistic=0,"Green" ,
Statistic=2,"Red",
Statistic=1,"Blue",
1==1, " " )
| appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count]
| stats latest(Status)

The region has 7 SOD status data i.e. red and green. ,The issue is if one sod is in red state it is still showing green status.

What I require is even if there is a single red status it has to be picked and not the green one , as I am using it in a dashboard.

Re: How to display a single error in multiple inputs?

ITWhisperer — Tue, 13 Jun 2023 12:05:07 GMT

case function is evaluated left to right, so put your highest priority condition first

| eval Status=case(Statistic=2,"Red", Statistic=1,"Blue", Statistic=0,"Green" , 1==1, " " )

Re: How to display a single error in multiple inputs?

Dayalss — Tue, 13 Jun 2023 12:45:00 GMT

Tried it , but still its showing green

Re: How to display a single error in multiple inputs?

ITWhisperer — Tue, 13 Jun 2023 13:04:35 GMT

Please share some sample events (anonymised as necessary) in a code block </> so we can see what you are dealing with.