Splunk Search

How to create couple of values in order to compare both field value

cros
Engager

Hi, 

Here is my raw data : 

ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found

I need to create another field for adding informations to this data. To do that i need to create couple of data. 

Record Number | Status 1     | Status 2                    | Result
10874384      | New          | Completed - Action Perfomed | Completed Actions
14688643      | New          | Investigating               | Work
14688643      | Investigating| Completed - Nothing Found   | Completed

I can not know in advance how many status could be by id (maybe 1, 2, 7 or more).

I do not know how to create couple with two different event in splunk. 

Regards,

Clement

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found"
| multikv forceheader=1 
| table ID, Version, Date, Status
| rename COMMENT as "the logic"
| streamstats window=2 list(Status) as tmp_status by ID
| where mvcount(tmp_status) > 1
| eval Status_1=mvindex(tmp_status,0),Status_2=mvindex(tmp_status,1)
| rex field=Status_2 "(?<Result>Completed)"
| eval Result=if(isnull(Result),"Work",Result)
| table ID Status_* Result
| rename ID as Record_number
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...