Monitoring Splunk

How to combine two different outputs of single field ?

Richy_s
Path Finder

 I have a splunk query that does some comparisons and the output is as follows.  If any of the row below for the given hostname has "OK", that host should be marked as "OK" ( irrespective of IP addresses it has).  can you help me with the right query pls ?

 

HostnameIP_Addressmatch
esx241.14.40.1missing
esx241.14.20.1ok
ctx-011.9.2.4missing
ctx-011.2.1.5missing
ctx-011.2.5.26missing
ctx-011.2.1.27missing
ctx-011.1.5.7ok
ctx-011.2.3.1missing
ctx-011.2.6.1missing
ctx-011.2.1.1missing
w1221.2.5.15ok
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(eval(if(match="ok",match,null()))) as match by Hostname

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(eval(if(match="ok",match,null()))) as match by Hostname

Richy_s
Path Finder

Exactly what I was looking for, thank you so much !! @ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...