Splunk Search

How to Set field to value of another with a where clause?

jpfrancetic
Path Finder

Hi Splunk Community,

I am trying to work with over writing fields using an if clause. The data I have is like what is in the table below:

Sourcetype Index LastSeenDate
clarity-A abc123 2-6-2023
clarity-B abc123 1-15-2023
clarity-C abc123 12-1-2022
DR:101:405 abc123 2-4-2023
BillingTool abc123 2-2-2023

 

I want to overwrite the current LastSeenDates only for clarity-B and clarity-C so that their last seen date is equal to the LastSeenDate for clarity-A. The table below is an example of what I am trying to achieve:

Sourcetype Index LastSeenDate
clarity-A abc123 2-6-2023
clarity-B abc123 2-6-2023
clarity-C abc123 2-6-2023
DR:101:405 abc123 2-4-2023
BillingTool abc123 2-2-2023
Labels (4)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your sourcetypes follow the pattern shown and your events are in time order, try something like this

| eval commonSourceType=mvindex(split(Sourcetype,"-"),0)
| eventstats latest(LastSeenDate) as LastSeenDate by commonSourceType
0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...