topic Re: Extracting a composite variable and comparing it with the rows of an index. in Splunk Search

Extracting a composite variable and comparing it with the rows of an index.

omcollia — Mon, 19 Feb 2024 14:47:44 GMT

"I have an issue with creating a field named 'Path' which should be populated with 'YES' or 'NO' based on the following information:

I have fields like 'Hostname', 'dev', and 'vulnerability'. I need to take the values in 'dev' and 'vulnerability' and check if there are other rows with the same 'hostname' and 'vulnerability'. If there is a match, I write 'NO' in the 'Path' field; otherwise, I write 'YES'."

Hostname	dev	vulnerabilita	patch
A	B	apache	SI
A	B	sql	NO
B	0	apache	NO
B	0	python	NO
C	A	apache	SI

Re: Extracting a composite variable and comparing it with the rows of an index.

ITWhisperer — Mon, 19 Feb 2024 14:55:17 GMT

It is not clear whether you are matching hostname and vulnerability or dev and vulnerability. In either case, your table doesn't appear to have any rows where patch should be NO (according to your logic). Please can you clarify your requirement.

If the table was supposed to be the result, rather than the events, please can you share some sample events.

Re: Extracting a composite variable and comparing it with the rows of an index.

omcollia — Tue, 20 Feb 2024 09:23:11 GMT

"I will have a table composed of Hostname, Dev (hostname of the development machine associated with the machine in the Hostname field), vulnerability (vulnerability associated with the machine in Hostname). The Dev field is only used to see if the machine in Hostname has a machine in development associated with it. I should verify that in my table there is not that machine (in this case in the hostname field) associated with the same vulnerability."

HOSTNAME	DEV	VULNERABILITà
PAPERINO	pippo	APACHE

In this case, my machine "paperino" has a vulnerability "apache", and it also has a development machine associated with it. Therefore, I should verify that for the machine "Pippo" there isn't the same vulnerability

HOSTNAME	DEV	VULNERABILITà
PIPPO	-	APACHE

If this row were present in my search, then in the row of the table above, I should write "YES" in my new field that I will create. because pippo have same vulnerability (apache )

Re: Extracting a composite variable and comparing it with the rows of an index.

ITWhisperer — Tue, 20 Feb 2024 10:46:43 GMT

Thanks for a clearer description of your usecase

Please try this

| eventstats values(Hostname) as hosts by vulnerability | eval patch=if(isnotnull(mvfind(hosts,dev)), "Yes", "No")