Splunk Search

How to table results with multiple evals?

aohls
Contributor

I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like:

Search Triggered Scheduled Test
TestAlert1

True

True True

 

Currently what I am getting is something like this:

Search Triggered Scheduled Test
TestAlert1 True False False
TestAlert1 False True False
TestAlert1 False False True

I am thinking I need to use xyseries chart but am not sure.

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I assume that you are saying that if a search has True anywhere, then it's True, otherwise false.

You could do something like

| stats values(*) as * by Search
| foreach * [ eval <<FIELD>>=if(isnotnull(mvfind(<<FIELD>>, "True")), "True", "False") ]

but you could also set values to 1 and 0 for True/False and then do

| stats max(*) as * by Search
| foreach Triggered	Scheduled Test [ eval <<FIELD>>=if(<<FIELD>>=1, "True", "False") ]
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...