Splunk Search
Highlighted

Set Table Row/field from another Row/Field

Explorer

Example:

|  ID  |  NAME | CASE_ID |
|  1   |   ABC  |  C101    |
|  2   |  XYZ   |  null    |
|  3   |  DFG  |  C505    |
|  4   |  QAZ   |  null    |

I would like to set Row(2) CaseID by Row(1) CaseId.
Likewise, QAZ-CaseID to DFGCaseID.
The requirement is to link ABC and XYZ together, when they have nothing in common, but the CaseId is used for both.

Final result:

|  ID  |  NAME    | CASE_ID |
|  1   |   ABC    |  C101   |
|  2   |   XYZ    |  C101   |
|  3   |  DFG     |  C505   |
|  4   |  QAZ     |  C505   |
0 Karma
Highlighted

Re: Set Table Row/field from another Row/Field

Explorer

Hardcoding is fine, for example:

if(NAME==QAZ) {
QAZ.CASEID = DFG.CASEID
}

0 Karma
Highlighted

Re: Set Table Row/field from another Row/Field

Legend

@wrussell12 seems like you need to add filldown to your current result. Please try out and confirm

 | filldown CASE_ID



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Set Table Row/field from another Row/Field

SplunkTrust
SplunkTrust

@wrussell12

Have you tried filldown?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/filldown

YOUR_SEARCH | table ID NAME CASE_ID | filldown CASE_ID

Sample Search:

| makeresults | eval t="1,ABC,C101|2,XYZ|3,DFG,C505|4,QAZ",t=split(t,"|") | mvexpand t | eval ID=mvindex(split(t,","),0),NAME=mvindex(split(t,","),1),CASE_ID=mvindex(split(t,","),2) 
| table ID NAME CASE_ID | filldown CASE_ID

Thanks