Splunk Search

Conditional logic and assigning values for group

mschellhouse
Path Finder

I am trying to categorize records that meet certain logic criteria. If logic is met, I want to assign a string value to category field for ALL events that share the same ID.

Example:
1. name=abc / ID=123xyz / data=loginfailure / category=
2. name=dce / ID=123xyz / data=primaryevent / category=

I am using conditional logic to find the existence of #2 and setting the category. This is the determining event with all events sharing that ID. The next step is to apply that same category to all events that have the same ID.

Step1 - locate record #2 and set category=websitelogin
Step2 - set category=websitelogin for all events that share the same ID as #2.

Desired End Result:
1. name=abc / ID=123xyz / data=loginfailure / category=websitelogin
2. name=dce / ID=123xyz / data=primaryevent / category=websitelogin

Thanks!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...