Splunk Search

Multivalue fields match issue

mbasharat
Contributor

Hi,

I have below sample dataset. This dataset is for an asset being compliant or not compliant. What I need is:

  • If an asset is tagged as compliant for some values and non compliant for some, I need non compliant to take precedence and show it as non compliant. Right now, I am seeing all values for example for asset1.
  • If an asset is compliant only, it stays as Compliant.
  • If an asset is NA only, it stays as Compliant.

Is:

1.png

To Be:

2.png

Thanks in-advance!!!

Labels (5)
0 Karma
1 Solution

scelikok
Champion

Hi @mbasharat,

Please try below after your base search;

| stats values(Status) as Status by DNS
| eval Status=case(Status="Non_Compliant","Non_Compliant",Status="NA","Compliant",1=1,Status)

 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

Hi @mbasharat,

Please try below after your base search;

| stats values(Status) as Status by DNS
| eval Status=case(Status="Non_Compliant","Non_Compliant",Status="NA","Compliant",1=1,Status)

 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!