Conditional logic and assigning values for group

[mschellhouse]

I am trying to categorize records that meet certain logic criteria. If logic is met, I want to assign a string value to category field for ALL events that share the same ID.

Example:
1. name=abc / ID=123xyz / data=loginfailure / category=
2. name=dce / ID=123xyz / data=primaryevent / category=

I am using conditional logic to find the existence of #2 and setting the category. This is the determining event with all events sharing that ID. The next step is to apply that same category to all events that have the same ID.

Step1 - locate record #2 and set category=websitelogin
Step2 - set category=websitelogin for all events that share the same ID as #2.

Desired End Result:
1. name=abc / ID=123xyz / data=loginfailure / category=websitelogin
2. name=dce / ID=123xyz / data=primaryevent / category=websitelogin

Thanks!

[martin_mueller · Accepted solution]

Step 1 would be something like | eval category = case(some boolean expression to determine category A, "A", some boolean expression to determine category B, "B", ...)

Step 2 could be | eventstats values(category) as category by ID if you need to do per-event things afterwards, or | stats values(category) as category something(otherfield) by ID if you only need to do reporting things afterwards.
In both approaches you'll need to deal with multiple categories assigned to one ID if that's possible in your data.