Splunk Search

How to save multiple values after multiple evaluation?

Gian89
Explorer

Hello Splunkers,

for a project I'm working on, I would need to store different IDs in a variable after evaluating them with if or case.
The idea is to check several conditions and if one or more are met, update the value of the variable.
Example:

event1: A | B | C 
event2: A | C | E
event3: B | F | G

Conditions:
if A is present  -> ID01
if B is present  -> ID02
if B is present  -> ID03

Result:
event1: ID01,ID02,ID03
event2: ID01,ID03
event3: ID02

I tried to concatenate the results but with no success:
| makeresults
| eval letter1="A", letter2="B", letter3="C"
| append
[| makeresults
| eval letter1="A", letter2="C", letter3="E"]
| append
[| makeresults
| eval letter1="B", letter2="F", letter3="G"]
| eval ID=""
| eval ID=ID.if(letter1="A" OR letter2="A" OR letter3="A","ID01",NULL)
| eval ID=ID.if(letter1="B" OR letter2="B" OR letter3="B",",ID02",NULL)
| eval ID=ID.if(letter1="C" OR letter2="C" OR letter3="C",",ID02",NULL)
|table letter1 letter2 letter3 ID

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval letter1="A", letter2="B", letter3="C"
| append
[| makeresults
| eval letter1="A", letter2="C", letter3="E"]
| append
[| makeresults
| eval letter1="B", letter2="F", letter3="G"]
| eval ID=""
| eval ID=if(letter1="A" OR letter2="A" OR letter3="A",ID.",ID01",ID)
| eval ID=if(letter1="B" OR letter2="B" OR letter3="B",ID.",ID02",ID)
| eval ID=if(letter1="C" OR letter2="C" OR letter3="C",ID.",ID03",ID)
| eval ID=trim(ID,",")
|table letter1 letter2 letter3 ID

View solution in original post

Gian89
Explorer

This is brilliant, thank you very much for your support!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval letter1="A", letter2="B", letter3="C"
| append
[| makeresults
| eval letter1="A", letter2="C", letter3="E"]
| append
[| makeresults
| eval letter1="B", letter2="F", letter3="G"]
| eval ID=""
| eval ID=if(letter1="A" OR letter2="A" OR letter3="A",ID.",ID01",ID)
| eval ID=if(letter1="B" OR letter2="B" OR letter3="B",ID.",ID02",ID)
| eval ID=if(letter1="C" OR letter2="C" OR letter3="C",ID.",ID03",ID)
| eval ID=trim(ID,",")
|table letter1 letter2 letter3 ID
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...