Splunk Search

How to table results with multiple evals?

aohls
Contributor

I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like:

Search Triggered Scheduled Test
TestAlert1

True

True True

 

Currently what I am getting is something like this:

Search Triggered Scheduled Test
TestAlert1 True False False
TestAlert1 False True False
TestAlert1 False False True

I am thinking I need to use xyseries chart but am not sure.

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I assume that you are saying that if a search has True anywhere, then it's True, otherwise false.

You could do something like

| stats values(*) as * by Search
| foreach * [ eval <<FIELD>>=if(isnotnull(mvfind(<<FIELD>>, "True")), "True", "False") ]

but you could also set values to 1 and 0 for True/False and then do

| stats max(*) as * by Search
| foreach Triggered	Scheduled Test [ eval <<FIELD>>=if(<<FIELD>>=1, "True", "False") ]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...