Splunk Search

Is there a way where I can tag events and add another field based on hierarchy?

patricianaguit
Explorer

is there a way where I can tag events and add another field based on hierarchy?

For example:

Id 1 has different initial tags (A,B,C, and D) since A is the highest, the final tag should be "A"

 ID   |                InitialTag               |  FinalTag
 1                        A                            A
 1                        B                            A
 1                        C                            A
 1                        D                            A

Tag Ranks:
A - 1st
B - 2nd
C -3rd
D - 4th

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi patricianaguit,

if InitialTag is a number you can use in the stats command the function max, e.g.

my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID

Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:

  Tag,Rank
  A,1
  B,2
  C,3
  D,4

and a search like this:

my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi patricianaguit,

if InitialTag is a number you can use in the stats command the function max, e.g.

my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID

Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:

  Tag,Rank
  A,1
  B,2
  C,3
  D,4

and a search like this:

my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID

Bye.
Giuseppe

0 Karma

patricianaguit
Explorer

thank you this worked for me!

0 Karma

koshyk
Super Champion

what's your logic to say A is the highest? (alphabetical order?)

0 Karma

493669
Super Champion

Try this:

|eventstats first(InitialTag) as FinalTag by ID
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...