https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178463#M51319 <P>Hi,</P> <P>I have data in Splunk DB which could be presented with this simplified table (real table has about 100 lines):</P> <P>Test_Name......Test_Result<BR /> test_1................PASS<BR /> test_2................FAIL<BR /> test_3................PARTIAL_PASS</P> <P>I need help in creating search string in Splunk which would give me the final result (in statistic tab) with the following logic:<BR /> Final result: PASS if all Test_Result(s) were PASS or PARTIAL_PASS<BR /> Final result: FAIL if at least one Test_Result were FAIL</P> <P>how search string should look like ?</P> <P>cheers,<BR /> Milan</P> Mon, 28 Sep 2020 19:10:34 GMT milande 2020-09-28T19:10:34Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178463#M51319 <P>Hi,</P> <P>I have data in Splunk DB which could be presented with this simplified table (real table has about 100 lines):</P> <P>Test_Name......Test_Result<BR /> test_1................PASS<BR /> test_2................FAIL<BR /> test_3................PARTIAL_PASS</P> <P>I need help in creating search string in Splunk which would give me the final result (in statistic tab) with the following logic:<BR /> Final result: PASS if all Test_Result(s) were PASS or PARTIAL_PASS<BR /> Final result: FAIL if at least one Test_Result were FAIL</P> <P>how search string should look like ?</P> <P>cheers,<BR /> Milan</P> Mon, 28 Sep 2020 19:10:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178463#M51319 milande 2020-09-28T19:10:34Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178464#M51320 <P>Let's approach it mathematically...</P> <PRE><CODE>| eval numerical_result = case ( Test_Result = "PASS", 1 , Test_Result="PARTIAL_PASS", 2 , Test_Result="FAIL" , 3 , 1=1, 0 ) | stats max(numerical_result) as numerical_result | eval result = case ( numerial_result = 1, "PASS", numerical_result =2, "PARTIAL_PASS", numerical_result = 3 , "FAIL" , 1=1, "UNKNOWN" ) </CODE></PRE> <P>So we make up a numerical equivalent to your PASS / PARTIAL_PASS / FAIL concepts and use <CODE>max()</CODE> to hit your criteria. Then we have to re-convert from numerics back to a textual representation.</P> <P>Maybe someone else has a better approach?</P> Tue, 17 Mar 2015 17:09:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178464#M51320 dwaddle 2015-03-17T17:09:57Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178465#M51321 <PRE><CODE>... | stats count(eval(Test_Result="Fail")) as failed, count(eval(Test_Result!="Fail")) as notfailed | eval Final_Result=if(failed&gt;0,"Fail",if(notfailed&gt;0,"Passed","NA")) | table Final_Result </CODE></PRE> <P>This will give a single row with fail if it finds even a single record of fail and calls them pass otherwise i.e. any not marked Fail are considered passed.</P> Wed, 18 Mar 2015 00:06:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178465#M51321 ramdaspr 2015-03-18T00:06:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178466#M51322 <P>@ dwaddle <BR /> you approach seems also OK but for a sake of "shortness" I choose answer from "ramdaspr". <BR /> Thanks dwaddle anyway! </P> Wed, 18 Mar 2015 09:35:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-return-quot-PASS-quot-if-all-search/m-p/178466#M51322 milande 2015-03-18T09:35:24Z