Multivalue fields match issue

[mbasharat]

Hi,

I have below sample dataset. This dataset is for an asset being compliant or not compliant. What I need is:

• If an asset is tagged as compliant for some values and non compliant for some, I need non compliant to take precedence and show it as non compliant. Right now, I am seeing all values for example for asset1.
• If an asset is compliant only, it stays as Compliant.
• If an asset is NA only, it stays as Compliant.

Is:

1.png

To Be:

2.png

Thanks in-advance!!!

[scelikok · Accepted solution]

Hi @mbasharat,

Please try below after your base search;

| stats values(Status) as Status by DNS
| eval Status=case(Status="Non_Compliant","Non_Compliant",Status="NA","Compliant",1=1,Status)