Splunk Search

Conditional logic and assigning values for group

mschellhouse
Path Finder

I am trying to categorize records that meet certain logic criteria. If logic is met, I want to assign a string value to category field for ALL events that share the same ID.

Example:
1. name=abc / ID=123xyz / data=loginfailure / category=
2. name=dce / ID=123xyz / data=primaryevent / category=

I am using conditional logic to find the existence of #2 and setting the category. This is the determining event with all events sharing that ID. The next step is to apply that same category to all events that have the same ID.

Step1 - locate record #2 and set category=websitelogin
Step2 - set category=websitelogin for all events that share the same ID as #2.

Desired End Result:
1. name=abc / ID=123xyz / data=loginfailure / category=websitelogin
2. name=dce / ID=123xyz / data=primaryevent / category=websitelogin

Thanks!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...