How to apply the condition in multivalue event?

[VsplunkV]

Splunk Experts,

How to write the eval command to compare the Multivalue, Below is data,

    **Servicename**    **Status**                                          ServerName
                                                                              NGS121
     Ad_service          Running
     CIM_service         Running
      Jabber             NotRunning
      Citrix             NotRunning.

IF any of the Status is "NotRunning" I should get the ServiceStatus as "Not-Running" O/P as

Servername                 ServiceStatus

NGS121                     Not-Running

[somesoni2 · Accepted solution]

Try like this

your current search giving multivalued field Status and other fields
| eval Status=if(isnotnull(mvfilter(Status,"NotRunning")),"NonRunning","Running")

[VsplunkV]

Thank you. It worked

[elliotproebstel]

This will create a field called ServiceStatus and assign it the value Not-Running if any value for Status is set to NotRunning, and then it will retain only the events where ServiceStatus="Not-Running":

[ your existing search ]
| eval ServiceStatus=if(like(Status, "NotRunning"), "Not-Running", "Running")
| where ServiceStatus="Not-Running"
| fields ServerName ServiceStatus

[VsplunkV]

Thank you. It worked.