Splunk Search

How do I write an eval statement to return "True" if there is only one non-zero value in a row, else "False"?

lynchs61
New Member

I have results with field names A, B, C, D that will look something like this;

A    B    C    D
0    10   0    0
1    0    4    5
0    3    8    0
0    0    0    2

I'm looking for some type of eval that will give me a true or false as to whether the fields have only ONE value that is non-zero. So in this case the first row (0, 10, 0, 0) and the last row (0, 0, 0, 2) are true and the other two are false.

I could test every permutation, but that seems inefficient. Is there a better way?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this will do it if you can put the fields into a single string called "foo", but it's untested.

... | rex field=foo max_match=0 "(?P<zeroes>^0| 0)" | eval onlyOne=if(mvcount(zeroes)==3, "true", "false") | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...