topic Re: I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure" in Splunk Search

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

nagarjuna280 — Tue, 29 Sep 2020 13:44:00 GMT

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

Re: I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

jpass — Tue, 29 Sep 2020 13:40:47 GMT

This might work. Use rex command to match status values and create a single multivalue field. Then use eventstats to sum the values of your multivalue field. If the sum of status = 0, set a new_field to "OK". Otherwise, set new_field to "FAILURE". In the search below you can disregard the 'makeresults' and 'eval _raw =' commands. I just add those to generate an example event like yours that I can use. You want REX & EVENTSTATS

| makeresults | EVAL _raw = "status=0 status=0 status=0" | REX max_match=0 field=_raw "status=(?P<status>[0-9])" | EVENTSTATS sum(status) AS status_sum | EVAL new_field=IF(status_sum==0,"OK","FAILURE")

Re: I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

gokadroid — Mon, 17 Apr 2017 06:57:26 GMT

Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):

aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0

Then how about trying this one:

your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field

Sample snapshot: