Hi Splunk Community,
I am trying to work with over writing fields using an if clause. The data I have is like what is in the table below:
Sourcetype | Index | LastSeenDate |
clarity-A | abc123 | 2-6-2023 |
clarity-B | abc123 | 1-15-2023 |
clarity-C | abc123 | 12-1-2022 |
DR:101:405 | abc123 | 2-4-2023 |
BillingTool | abc123 | 2-2-2023 |
I want to overwrite the current LastSeenDates only for clarity-B and clarity-C so that their last seen date is equal to the LastSeenDate for clarity-A. The table below is an example of what I am trying to achieve:
Sourcetype | Index | LastSeenDate |
clarity-A | abc123 | 2-6-2023 |
clarity-B | abc123 | 2-6-2023 |
clarity-C | abc123 | 2-6-2023 |
DR:101:405 | abc123 | 2-4-2023 |
BillingTool | abc123 | 2-2-2023 |
Assuming your sourcetypes follow the pattern shown and your events are in time order, try something like this
| eval commonSourceType=mvindex(split(Sourcetype,"-"),0)
| eventstats latest(LastSeenDate) as LastSeenDate by commonSourceType