Getting Data In

Filter condition based on multiple events

mahesh_ravji1
Explorer

Hi There,
I have a search that outputs table data that looks like this:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-CCC User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

I would like to filter this table so that ‘Service-CCC’ is removed if the same user also has ‘Service-BBB’. The ‘Service-CCC’ should be kept if the user does not have ‘Service-BBB’. So the filtered output should be:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

Thanks in advance.

Tags (1)

somesoni2
Revered Legend

Try this

Your base search giving Customer Service User fields | eventstats values(Service) as Services by User | eval include=if(isnotnull(mvfind(Services,"Service-BBB")) AND isnotnull(mvfind(Services,"Service-CCC")) AND Service="Service-CCC",0,1) | where include=1 | fields - include Services

mahesh_ravji1
Explorer

Thanks very much - this solved my problem 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...