Splunk Search

Conditional logic and assigning values for group

mschellhouse
Path Finder

I am trying to categorize records that meet certain logic criteria. If logic is met, I want to assign a string value to category field for ALL events that share the same ID.

Example:
1. name=abc / ID=123xyz / data=loginfailure / category=
2. name=dce / ID=123xyz / data=primaryevent / category=

I am using conditional logic to find the existence of #2 and setting the category. This is the determining event with all events sharing that ID. The next step is to apply that same category to all events that have the same ID.

Step1 - locate record #2 and set category=websitelogin
Step2 - set category=websitelogin for all events that share the same ID as #2.

Desired End Result:
1. name=abc / ID=123xyz / data=loginfailure / category=websitelogin
2. name=dce / ID=123xyz / data=primaryevent / category=websitelogin

Thanks!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...