Hello experts,
I'm stuck trying to figure out how to filter the following data set to get the results shown below. Any assistance would be greatly appreciated.
Sample results
c_1 f_1 f_2 f_3 f_4 f_5
x001f 1 0 0 0 0
x0883g 1 0 0 0 0
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
x883kd n n n
I'd like to do a filter by using a field wildcard f_* and > 1 and have it return the complete matching line; like the one below.
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
I tried doing the following, but no luck...
| foreach f_*
[ eval total=total + '<<FIELD>>']
|where total > 1
@splunker1981
Can you please add | eval total=0
in you search and try again?
My Sample Search
| makeresults
| eval _raw="
c_1 f_1 f_2 f_3 f_4 f_5
x001f 1 0 0 0 0
x0883g 1 0 0 0 0
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
"
| multikv | eval total=0
| foreach f_*
[ eval total=total + '<<FIELD>>']
| where total > 1
Thanks
Thanks for the response! The problem is that it's adding up all the values which is NOT what I want. I just want to iterate through each of the f_* fields, see if the value for each of those fields is > 1 (independent of one another) and print those rows if any of the f_* have a value > 1
@splunker1981
Can you please try this?
YOUR_SEARCH | eval status=0
| foreach f_*
[ eval status=if('<<FIELD>>' > 1 AND status==0,1,status) ] | where status=1
Sample:
| makeresults
| eval _raw="
c_1 f_1 f_2 f_3 f_4 f_5
x001f 1 0 0 0 0
x0883g 1 0 0 0 0
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
"
| multikv | eval status=0
| foreach f_*
[ eval status=if('<<FIELD>>' > 1 AND status==0,1,status) ] | where status=1
Still not working when I run against my data. I did notice that using your command I get the desired results. when I specifically filter using |search for the 10 results that should match, then the search works. But if I remember the |where I only get 1 match....
@splunker1981
Apology for a delay in reply. Can you please share more information regarding your search and samples?