Splunk Cloud Platform

How to display result when two fields are dependent

Splunkerninja
Path Finder

Hi,

I want to display the result only for users who  has both ID  AR9 & AD. Below is sample data, I have about 10k results being generated with multiple values but i need to display only those users who has ID both AR9 & AD 

USER

 ID

John

AD

John

AY9

Riya

AD

Toby

AR9

Nathan

AD

Nathan

AR9

Sam

AD

Sam

AR9

 

Thanks!

 

Tags (5)
0 Karma
1 Solution

tej57
Path Finder

Hey @Splunkerninja,

I used makeresults to get a statistical table as provided in the question. You can use the below query to identify a User that has ID to be "AD" and "AR9"

| makeresults 
| eval User="John", ID="AD" 
| append 
    [| makeresults 
    | eval User="John", ID="AY9"]
| append 
    [| makeresults 
    | eval User="Riya", ID="AD"]
| append 
    [| makeresults 
    | eval User="Toby", ID="AR9"]
| append 
    [| makeresults 
    | eval User="Nathan", ID="AD"]
| append 
    [| makeresults 
    | eval User="Nathan", ID="AR9"]
| append 
    [| makeresults 
    | eval User="Sam", ID="AD"]
| append 
    [| makeresults 
    | eval User="Sam", ID="AR9"]
| fields - _time
| table User ID
| stats values(ID) as ID by User
| mvcombine ID delim=""
| eval match=if(match(ID,"AD AR9"),1,0)
| search match="1"

 

Thanks,
Tejas.

---

If the above solution is helpful, an upvote is appreciated.

View solution in original post

tej57
Path Finder

Hey @Splunkerninja,

I used makeresults to get a statistical table as provided in the question. You can use the below query to identify a User that has ID to be "AD" and "AR9"

| makeresults 
| eval User="John", ID="AD" 
| append 
    [| makeresults 
    | eval User="John", ID="AY9"]
| append 
    [| makeresults 
    | eval User="Riya", ID="AD"]
| append 
    [| makeresults 
    | eval User="Toby", ID="AR9"]
| append 
    [| makeresults 
    | eval User="Nathan", ID="AD"]
| append 
    [| makeresults 
    | eval User="Nathan", ID="AR9"]
| append 
    [| makeresults 
    | eval User="Sam", ID="AD"]
| append 
    [| makeresults 
    | eval User="Sam", ID="AR9"]
| fields - _time
| table User ID
| stats values(ID) as ID by User
| mvcombine ID delim=""
| eval match=if(match(ID,"AD AR9"),1,0)
| search match="1"

 

Thanks,
Tejas.

---

If the above solution is helpful, an upvote is appreciated.

Splunkerninja
Path Finder

@tej57 Thanks but how can i include _time as well in the result since after mvcombine the _time data gets dropped

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...