Splunk Search

Multivalue fields match issue

mbasharat
Contributor

Hi,

I have below sample dataset. This dataset is for an asset being compliant or not compliant. What I need is:

  • If an asset is tagged as compliant for some values and non compliant for some, I need non compliant to take precedence and show it as non compliant. Right now, I am seeing all values for example for asset1.
  • If an asset is compliant only, it stays as Compliant.
  • If an asset is NA only, it stays as Compliant.

Is:

1.png

To Be:

2.png

Thanks in-advance!!!

Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @mbasharat,

Please try below after your base search;

| stats values(Status) as Status by DNS
| eval Status=case(Status="Non_Compliant","Non_Compliant",Status="NA","Compliant",1=1,Status)

 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @mbasharat,

Please try below after your base search;

| stats values(Status) as Status by DNS
| eval Status=case(Status="Non_Compliant","Non_Compliant",Status="NA","Compliant",1=1,Status)

 

If this reply helps you an upvote is appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>