Splunk Search

Set attribute for all elements having a certain ID when 2 values are availabe witin the elements having this id

lukas1
Explorer

Hi everyone,

I try to set an attribute to true for all elements having a certain ID, when 2 defined activities are available for that certain ID.

In my optinion the corresponding SQL query would be:

  Update t set isvalid = true where id in (select id from t group by id having activity = 'a' and activity = 'b')

 

A result might look like:

idactivitiyistrue
001atrue
001btrue
001ctrue
002afalse
002cfalse
002dfalse
003atrue
003btrue

 

Is there an option to execute this in SPL?

 

Thanks,

Lukas

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(activity) as activities by id
| eval istrue=if(isnotnull(mvfind(activities,"a")) and isnotnull(mvfind(activities,"b")),"true","false")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(activity) as activities by id
| eval istrue=if(isnotnull(mvfind(activities,"a")) and isnotnull(mvfind(activities,"b")),"true","false")

lukas1
Explorer

Thank you @ITWhisperer !

 

Working now :grinning_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...