Splunk Search

How to create couple of values in order to compare both field value

cros
Engager

Hi, 

Here is my raw data : 

ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found

I need to create another field for adding informations to this data. To do that i need to create couple of data. 

Record Number | Status 1     | Status 2                    | Result
10874384      | New          | Completed - Action Perfomed | Completed Actions
14688643      | New          | Investigating               | Work
14688643      | Investigating| Completed - Nothing Found   | Completed

I can not know in advance how many status could be by id (maybe 1, 2, 7 or more).

I do not know how to create couple with two different event in splunk. 

Regards,

Clement

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found"
| multikv forceheader=1 
| table ID, Version, Date, Status
| rename COMMENT as "the logic"
| streamstats window=2 list(Status) as tmp_status by ID
| where mvcount(tmp_status) > 1
| eval Status_1=mvindex(tmp_status,0),Status_2=mvindex(tmp_status,1)
| rex field=Status_2 "(?<Result>Completed)"
| eval Result=if(isnull(Result),"Work",Result)
| table ID Status_* Result
| rename ID as Record_number
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...