Splunk Search
Highlighted

How do I write an eval statement to return "True" if there is only one non-zero value in a row, else "False"?

New Member

I have results with field names A, B, C, D that will look something like this;

A    B    C    D
0    10   0    0
1    0    4    5
0    3    8    0
0    0    0    2

I'm looking for some type of eval that will give me a true or false as to whether the fields have only ONE value that is non-zero. So in this case the first row (0, 10, 0, 0) and the last row (0, 0, 0, 2) are true and the other two are false.

I could test every permutation, but that seems inefficient. Is there a better way?

0 Karma
Highlighted

Re: How do I write an eval statement to return "True" if there is only one non-zero value in a row, else "False"?

SplunkTrust
SplunkTrust

I think this will do it if you can put the fields into a single string called "foo", but it's untested.

... | rex field=foo max_match=0 "(?P<zeroes>^0| 0)" | eval onlyOne=if(mvcount(zeroes)==3, "true", "false") | ...
---
If this reply helps you, an upvote would be appreciated.
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.