Splunk Search

Need SPL advise for stats

k31453
Explorer

I have following data:

k31453_0-1618471498307.png


I am trying to generate SPL which provides me following:

k31453_1-1618471517925.png


Essentially change_complete will be new field and will be marked "Yes" only if all the hosts for that particular customer  has flag_enabled = "Yes" otherwise change_complete=No

I am trying to use eval or stats function to get around it. But I got no luck.

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="customer,host,flag_enabled
abc,host1,yes
abc,host2,no
fax,host1,yes
fax,host2,yes"
| multikv forceheader=1
| fields customer host flag_enabled
| fields - _*
| stats count count(eval(flag_enabled=="yes")) as enabled_count by customer
| eval change_complete=if(count==enabled_count,"yes","no")
| fields customer change_complete

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="customer,host,flag_enabled
abc,host1,yes
abc,host2,no
fax,host1,yes
fax,host2,yes"
| multikv forceheader=1
| fields customer host flag_enabled
| fields - _*
| stats count count(eval(flag_enabled=="yes")) as enabled_count by customer
| eval change_complete=if(count==enabled_count,"yes","no")
| fields customer change_complete
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...