Dashboards & Visualizations

How to combine similar and different values of two fields together?

din98
Explorer




Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @din98 ,

you have to normalize your field and I hint to do this in a calculated field and not in your search.

In few word, you have to create two eval commands like thie following:

| eval 
   state1=case(state1="Completed","Successful",state1="Faulted","Successful"),
   state2=case(state2="Completed","Successful",state2="Faulted","Successful")

you can try them in a search, but after the test I hint to put then in two calculated fields.

then in the search use the coalesce option in the eval command

| eval state=coalesce(state1,state2)

Ciao.

Giuseppe

0 Karma

din98
Explorer

 ,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @din98,

you can add all the conditions you have, I don't know if it's possible in your logs, but you could have:

| eval 
   state1=case(state1="Completed","Successful",state1="Faulted","Successful",state2="Pending","Pending"),
   state2=case(state2="Completed","Successful",state2="Faulted","Successful",state2="Pending","Pending")

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...