Hi,
Here is my raw data :
ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found
I need to create another field for adding informations to this data. To do that i need to create couple of data.
Record Number | Status 1 | Status 2 | Result
10874384 | New | Completed - Action Perfomed | Completed Actions
14688643 | New | Investigating | Work
14688643 | Investigating| Completed - Nothing Found | Completed
I can not know in advance how many status could be by id (maybe 1, 2, 7 or more).
I do not know how to create couple with two different event in splunk.
Regards,
Clement
index=_internal | head 1 | fields _raw
| eval _raw="ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found"
| multikv forceheader=1
| table ID, Version, Date, Status
| rename COMMENT as "the logic"
| streamstats window=2 list(Status) as tmp_status by ID
| where mvcount(tmp_status) > 1
| eval Status_1=mvindex(tmp_status,0),Status_2=mvindex(tmp_status,1)
| rex field=Status_2 "(?<Result>Completed)"
| eval Result=if(isnull(Result),"Work",Result)
| table ID Status_* Result
| rename ID as Record_number