Getting Data In

Filter condition based on multiple events

mahesh_ravji1
Explorer

Hi There,
I have a search that outputs table data that looks like this:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-CCC User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

I would like to filter this table so that ‘Service-CCC’ is removed if the same user also has ‘Service-BBB’. The ‘Service-CCC’ should be kept if the user does not have ‘Service-BBB’. So the filtered output should be:

Customer    Service_Name    User
Customer-123    Service-AAA User-A
Customer-123    Service-BBB User-A
Customer-123    Service-AAA User-B
Customer-123    Service-BBB User-B
Customer-123    Service-AAA User-C
Customer-123    Service-CCC User-C

Thanks in advance.

Tags (1)

somesoni2
Revered Legend

Try this

Your base search giving Customer Service User fields | eventstats values(Service) as Services by User | eval include=if(isnotnull(mvfind(Services,"Service-BBB")) AND isnotnull(mvfind(Services,"Service-CCC")) AND Service="Service-CCC",0,1) | where include=1 | fields - include Services

mahesh_ravji1
Explorer

Thanks very much - this solved my problem 🙂

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...