My scenario is thus:
The main search searches for a pattern in a sourcefile:
source="/apps.log" index=idx "abc" | xmlkv | Search TransactionStatus=Complete |table _time SerialNumber
It then looks up the SerialNo field in another search result, say:
search source="/apps.log" index=idx "edf" | xmlkv | search CoverageCd=Done |table SerialNo
If the SerialNumber in the main search is found the in the SerialNo in the subsearch, then I need to create a new Boolean field called Found and set it to True, for all those events that are found in the subsearch, the field is set to False.
I can easily offload the data to Python dataframes and achieve this but really need to do it within Splunk for online efficiency.
Could anyone help on this?
Thanks
Try this:
source="/apps.log" index=idx "abc" OR "edf" | xmlkv
| eval comboSerial=coalesce(SerialNo, SerialNumber)
| eventstats count(eval(searchmatch("edf AND CoverageCd=Done"))) AS Found BY comboSerial
| search "abc" AND TransactionStatus="Complete"
| table _time SerialNumber Found
Splunk reports:
Error in 'eventstats' command: The eval expression for dynamic field 'eval(searchmatch("abc" AND CoverageCd="Done"))' is invalid. Error='Typechecking failed. 'AND' only takes boolean arguments.'
I forgot an end-parenthesis; I edited and fixed it. Try it again.
The parenthesis are matched, but the error message is still the same. The searchmatch only accepts "edf AND Done" like argument.
You are correct; too many double-quotes. I fixed it AND tested it this time!
source="/apps.log" index=idx "abc" OR "edf"
| xmlkv
| search TransactionStatus=Complete OR CoverageCd=Done
| eval Found=if(SerialNumber=SerialNo,"True","False")
| table _time SerialNumber SerialNo Found
This does not work as the two search results have different structures. The results of
source="/apps.log" index=idx "abc" OR "edf" | xmlkv | search TransactionStatus=Complete OR CoverageCd=Done |table SerialNumber SerialNo
looks like:
SerialNumber SerialNo
ADH001
........... ADH001
ADH002
ADH003
........... ADH003
etc.
as they are in different events, they never get matched with each other.