Help with case statement affected by a transaction

jxiongjx — Mon, 13 Jun 2016 21:29:03 GMT

Each of the events in my log files has a data value for example, Data = a
I am using a transaction to group my events from start to end but I want to use eval and a case statement to create another variable that can describe the transaction.

For example,
Event1: Data = start
Event2: Data = c
Event3: Data = a
Event4: Data = a
Event4: Data = end

So for this example, I want a variable named poles that would be "ac" since a and c are the only distinct data in my transaction.

Currently I have

.... |transaction startswith = "start" endswith = "end"
|eval poles = case(Data=="a" AND Data=="b" AND Data=="c" AND Data=="d", "abcd", Data=="a" AND Data=="b", "ab", ... , 1==1, "Other")

My case statement has many different cases to fit the different combination for 4 different possible values for Data and one general case for "Other" in case no other cases fit. When I tested my search, each transaction came back as "Other" when none of them should be. I was hoping that testing for Data=="a" AND Data=="c" and similar statements would account for any event in the transaction would make this true like how the example has Event3 with Data = a, and Event2 with Data = c to get the desired poles string. But it seems that the case statement is checking individual events to see if that one event fits all the conditional logic criteria (which it clearly doesn't) so it defaults to "Other"

I'm not quite sure how else to check for distinct Data values (as some events have data that I don't care about, just the specific 4: a,b,c,d) and be able to output a new variable to display which are the distinct values in a transaction.

Re: Help with case statement affected by a transaction

sundareshr — Mon, 13 Jun 2016 22:00:52 GMT

transaction command creates multi-value fields and you need to use mv functions to manipulate the data. In your example you may want to look at mvfilter()

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

Re: Help with case statement affected by a transaction

jxiongjx — Tue, 14 Jun 2016 15:15:36 GMT

Thanks! this worked perfectly

topic Re: Help with case statement affected by a transaction in Splunk Search

Help with case statement affected by a transaction

Re: Help with case statement affected by a transaction

Re: Help with case statement affected by a transaction