How to replace any multi values found in search result with true and if the value is null replace with No

[vinaykataaig]

Hi there!
I am updating my question:
Below is the scenario where I wanted to see what are the servers got patched since last 3 months. My query pulls up the below table showing server name and patches installed by month and if there is not patched installed for that specific month i did a fill null values to show as "Not Patched". By doing this we just wanted to check if the server is patched for that month or not, we don't need the patch names to be shown.So I wanted to replace all those patch names to some other values like "True"/Patched/yes.

[mayurr98 · Accepted solution]

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]

[vinaykataaig]

Actually First search worked for me. Thank you!!
And also i thought of doing it another way as well, Just by writing eval logic if the count(Applicable Patch) >"0" then show Patched if the value is null then Not patched.

| replace * WITH "Patched" IN ApplicablePatch
| chart values(ApplicablePatch) as ApplicablePatch by server Month
| fillnull value="Not Patched"

[richgalloway]

What is your query? What exactly do you want replaced with "True/Yes"?

[vinaykataaig]

Thanks for the response, I have updated my question.

[richgalloway]

Please share your query.

[vinaykataaig]

index="oswin" sourcetype="windowsupdatelog" |search "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED"

| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)"
| eval server = Upper(mvindex(split(host,"."),-0))
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval Month = Upper(date_month)
| chart values(ApplicablePatch) as ApplicablePatch by server Month | fillnull value="Not Patched"

[mayurr98]

I have updated my answer pls try if it doesn't work then could you provide the splunk query to get this result?