Splunk Search

Use of == with or operator

arabhi
New Member

I want to compare some data with fields and then rename the data matched with fields. Since we have large set of data and comparing of all those data with fields it makes query bulky. Can anyone give efficient code for this??

Example: stats count(eval(fieldname=="some data" OR fieldname=="some data")) as XYZ count(eval(fieldname=="some data" OR fieldname=="some data" OR fieldname=="some data" fieldname=="some data" fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data")) as ABC..............by fieldname


Tags (1)
0 Karma
1 Solution

PavelP
Motivator

Hello @arabhi,

 stats count(eval(fieldname IN ("value1", "value2", "value3"))) AS XYZ

View solution in original post

0 Karma

PavelP
Motivator

Hello @arabhi,

 stats count(eval(fieldname IN ("value1", "value2", "value3"))) AS XYZ
0 Karma

to4kawa
Ultra Champion

make CSV for lookup and use lookup command
and aggregate the output

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...