Splunk Search

How to create couple of values in order to compare both field value

cros
Engager

Hi, 

Here is my raw data : 

ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found

I need to create another field for adding informations to this data. To do that i need to create couple of data. 

Record Number | Status 1     | Status 2                    | Result
10874384      | New          | Completed - Action Perfomed | Completed Actions
14688643      | New          | Investigating               | Work
14688643      | Investigating| Completed - Nothing Found   | Completed

I can not know in advance how many status could be by id (maybe 1, 2, 7 or more).

I do not know how to create couple with two different event in splunk. 

Regards,

Clement

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="ID, Version, Date, Status
10874381,1,2020-01-15T08:36:00Z,New
10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed
14688643,1,2016-10-06T06:30:00Z,New
14688643,1,2016-10-07T08:32:00Z,Investigating
14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found"
| multikv forceheader=1 
| table ID, Version, Date, Status
| rename COMMENT as "the logic"
| streamstats window=2 list(Status) as tmp_status by ID
| where mvcount(tmp_status) > 1
| eval Status_1=mvindex(tmp_status,0),Status_2=mvindex(tmp_status,1)
| rex field=Status_2 "(?<Result>Completed)"
| eval Result=if(isnull(Result),"Work",Result)
| table ID Status_* Result
| rename ID as Record_number
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...