Splunk Search

How to compare last column with previously violated column under foreach?

sangs8788
Communicator

Hi

I have a query which results me data in the below format,

Screenshot 2021-05-26 at 6.52.22 PM.png

I am trying to put out a table assigning priority based on the response(>2s is violator) for module and number of times violation occurred. 

 

 

| foreach *-2020 or *-2021
[ | eval LastViolatedMonth = if('<<FIELD>>'>2,"<<FIELD>>", LastViolatedMonth)
       , LastViolatedMonthNumber = substr(LastViolatedMonth, 0, 2)
       , ViolationCount=if(('<<FIELD>>'>2), ViolationCount+1, ViolationCount)
       , LastViolatedResponse=if('<<FIELD>>'>2,'<<FIELD>>', LastViolatedResponse)
       , Deviation=case(LastViolatedResponse>2,round(((LastViolatedResponse-2)/2)*100,1))
       , Priority = case(
                        (Deviation >= 100 AND ViolationCount >=1), "P1"
                      , ((Deviation >= 75 AND Deviation < 100) AND ViolationCount >=3), "P1"
                      , ((Deviation >= 75 AND Deviation < 100) AND (ViolationCount >= 0 AND ViolationCount < 3)), "P2" 
                      , ((Deviation >= 50 AND Deviation < 75) AND ViolationCount >= 3), "P2"
                      )]
| fields Module, LastViolatedMonth, LastViolatedResponse, ViolationCount, Deviation, Priority

 

 

Currently the Module is considered P1 violator when the violation count is >3.

I would like to add one more condition to check for the previous month response - if it was a violator or not.If previous month is not a violator but the latest/last month is a violator and the violation count >=3, I want that module to be marked as P2(not P1).

I am not sure how to check the previous column value(that is previous month value - to check if it violated then) against the last/latest month under for each statement. Could someone please help me out here.

 @bowesmana Can you help me on this. Thanks

Labels (4)
Tags (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...