Splunk Search

How to check for the same values in a field and replace another field with specific text

FyazIkram834
Engager

So currently  i have:

|Name                     | Branch                    | Age

---------------------------------------------------------
|   Tom                     |  USA                          | 21
|   Tom                     |  India                         | 23
|    Pat                      |  India                         | 26

If someone can please show me how to find the "Tom" matches on the "Name" field and then change the branches to USA for both the toms. 
Thanks.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats count by Name
| eval Branch=if(count>1,"USA",Branch)

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@FyazIkram834 

Can you please try this?

YOUR_SEARCH | eventstats values(Branch) as Branches by Name
| eval Branch=if(mvfind(Branches,"USA")>0,"USA",Branch) | fields - Branches

 

My Sample Search :

| makeresults | eval _raw="Name,Branch,Age
Tom,USA,21
Tom,India,23
Pat,India,26" | multikv forceheader=1
| table Name,Branch,Age | eventstats values(Branch) as Branches by Name
| eval Branch=if(mvfind(Branches,"USA")>0,"USA",Branch) | fields - Branches


 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Branch=if(Name="Tom","USA",Branch)
0 Karma

FyazIkram834
Engager

@ITWhisperer . There are more than just one same Name. like there are more different matching names. I just gave that as an example. Thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I guessed as much so you will have to give more information, for example, do you want all matching names to be USA branch? Do you want all matching names to be the first branch? If so, what determines first?

0 Karma

FyazIkram834
Engager

Yes i would like to have all matching names to be USA branch. @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats count by Name
| eval Branch=if(count>1,"USA",Branch)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...