Getting Data In

Filter condition based on multiple events

mahesh_ravji1
Explorer

Hi There,
I have a search that outputs table data that looks like this:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-CCC User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

I would like to filter this table so that ‘Service-CCC’ is removed if the same user also has ‘Service-BBB’. The ‘Service-CCC’ should be kept if the user does not have ‘Service-BBB’. So the filtered output should be:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

Thanks in advance.

Tags (1)

somesoni2
Revered Legend

Try this

Your base search giving Customer Service User fields | eventstats values(Service) as Services by User | eval include=if(isnotnull(mvfind(Services,"Service-BBB")) AND isnotnull(mvfind(Services,"Service-CCC")) AND Service="Service-CCC",0,1) | where include=1 | fields - include Services

mahesh_ravji1
Explorer

Thanks very much - this solved my problem 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...