I have a splunk query that does some comparisons and the output is as follows. If any of the row below for the given hostname has "OK", that host should be marked as "OK" ( irrespective of IP addresses it has). can you help me with the right query pls ?
Hostname | IP_Address | match |
esx24 | 1.14.40.1 | missing |
esx24 | 1.14.20.1 | ok |
ctx-01 | 1.9.2.4 | missing |
ctx-01 | 1.2.1.5 | missing |
ctx-01 | 1.2.5.26 | missing |
ctx-01 | 1.2.1.27 | missing |
ctx-01 | 1.1.5.7 | ok |
ctx-01 | 1.2.3.1 | missing |
ctx-01 | 1.2.6.1 | missing |
ctx-01 | 1.2.1.1 | missing |
w122 | 1.2.5.15 | ok |
| eventstats values(eval(if(match="ok",match,null()))) as match by Hostname
| eventstats values(eval(if(match="ok",match,null()))) as match by Hostname
Exactly what I was looking for, thank you so much !! @ITWhisperer