Splunk Search

How to rewrite the id with a type value of 2 to the id value with a type value of 1 for data with the same axid value?

tehong
Explorer

Hi experts,

Could you please advise me about SPL?

Given the data below, I would like to rewrite the id with a type value of 2 to the id value with a type value of 1 for data with the same axid value.

----------------------
axid, id, type
----------------------
0001,abc,1
0001,def,2
0001,ghi,2
0002,jkl,1
0002,mno,2
0002,pqr,2

Expected results follow

----------------------
axid, id, type
----------------------
0001,abc,1
0001,abc,2
0001,abc,2
0002,jkl,1
0002,jkl,2
0002,jkl,2

Thanks in adance!!

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval type1id=if(type=1,id,null())
| eventstats values(type1id) as id by axid

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval type1id=if(type=1,id,null())
| eventstats values(type1id) as id by axid

tehong
Explorer

Perfect Thanks Whisperer!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...