Splunk Search

How to edit my search to add a third column to my table results if there are certain values in the first

athorat
Communicator

I want to add a column "FinalType" in a statistical table, so when the EventType=ScoreLock and TxnType=Renewal, it should show the value "Scorelock" in the FinalType column. The results should look like this:

EventType           TxnType              FinalType

ScoreLock           Renewal              ScoreLock  
Bind                 Endorsement          Exception     
Renewal Offer       Renewal           EUBI

I am currently using this search to display these results:

index="np_dpa" sit-api-monitor  EventType="[request]" OR EventType="[error]"  PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType 
0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType  | eval FinalType=case(eventType="ScoreLock" AND transactionType="Renewal","ScoreLock",eventType="Bind" AND transactionType="Endorsement","Exception",1=1,"EUBI")

View solution in original post

somesoni2
Revered Legend

How about this

index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType  | eval FinalType=case(eventType="ScoreLock" AND transactionType="Renewal","ScoreLock",eventType="Bind" AND transactionType="Endorsement","Exception",1=1,"EUBI")

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.