Grouping fields in a search: How do I apply conditional logic to the results to assign new values?

[katzr]

I have a table that has UserID, device, and classification (1,2,3). A UserID can have multiple devices and a device can have multiple UserIDs. As of now, the row of data has a classification based on other factors for each row containing a device and UserID.

This means a userID may have many different classifications for each of their devices. I want to change the classification for each user to the highest classification. For example: a UserID has 4 devices with a classification of 1,2,2,3. I want to change the classification for each of these to 3 because that is the max of the classification for that UserID.

I need help with the logic of this and how I can group the UserID to find the number of devices per UserID and then use if statements to change the classification?

[DalJeanis]

Do you want every row for each user updated to have the highest classification on any row? or are you just wanting a search that brings back the highest classification for each user?

This gives you a single record for each UserID, with a list of their devices, and the highest classification

your search that brings UserID, device, classification
| stats list(device) as device max(classification) as classification by UserID

This gives you each record that you currently have, marked with the highest classification that user has.

your search that brings UserID, device, classification
 | eventstats max(classification) as classification by UserID

This gives you one record for each combination of userID and device, marked with the highest classification that user has.

your search that brings UserID, device, classification
 | eventstats max(classification) as maxclass by UserID
 | stats max(maxclass) as classification by UserID device