Splunk Search

Help with case statement affected by a transaction

jxiongjx
Engager

Each of the events in my log files has a data value for example, Data = a
I am using a transaction to group my events from start to end but I want to use eval and a case statement to create another variable that can describe the transaction.

For example,
Event1: Data = start
Event2: Data = c
Event3: Data = a
Event4: Data = a
Event4: Data = end

So for this example, I want a variable named poles that would be "ac" since a and c are the only distinct data in my transaction.

Currently I have

.... |transaction startswith = "start" endswith = "end"
|eval poles = case(Data=="a" AND Data=="b" AND Data=="c" AND Data=="d", "abcd", Data=="a" AND Data=="b", "ab", ... , 1==1, "Other")

My case statement has many different cases to fit the different combination for 4 different possible values for Data and one general case for "Other" in case no other cases fit. When I tested my search, each transaction came back as "Other" when none of them should be. I was hoping that testing for Data=="a" AND Data=="c" and similar statements would account for any event in the transaction would make this true like how the example has Event3 with Data = a, and Event2 with Data = c to get the desired poles string. But it seems that the case statement is checking individual events to see if that one event fits all the conditional logic criteria (which it clearly doesn't) so it defaults to "Other"

I'm not quite sure how else to check for distinct Data values (as some events have data that I don't care about, just the specific 4: a,b,c,d) and be able to output a new variable to display which are the distinct values in a transaction.

0 Karma
1 Solution

sundareshr
Legend

transaction command creates multi-value fields and you need to use mv functions to manipulate the data. In your example you may want to look at mvfilter()

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

View solution in original post

0 Karma

sundareshr
Legend

transaction command creates multi-value fields and you need to use mv functions to manipulate the data. In your example you may want to look at mvfilter()

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

0 Karma

jxiongjx
Engager

Thanks! this worked perfectly

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...