Splunk Search

set a flag in based on field value in multiple row

LearningGuy
Motivator

Hello,
How do I set a flag in based on field value in multiple row?
For example:
In the following table,  network-1 is set to yes because server-1 that is on network-1 is also on fw-network-1 that is behind a firewall.   

Please suggest. Thank you!!

servernetworkfirewall
server-1network-1yes
server-1fw-network-1yes
server-2network-2no
server-3network-1yes
server-3fw-network-1yes
server-4network-2no
server-5network-3yes
server-5fw-network-3yes
Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

There are a number of ways to do this - the example below uses makeresults to create your example data 

Simple way 1 - use eventstats to collect all networks for each server and then check if the results contain fw-network-X where X is the network the server is on

| makeresults format=csv data="server,network,firewall
server-1,network-1,yes
server-1,fw-network-1,yes
server-2,network-2,no
server-3,network-1,yes
server-3,fw-network-1,yes
server-4,network-2,no
server-5,network-3,yes
server-5,fw-network-3,yes"
| fields - firewall
``` Above creates your example table ```
| eventstats values(network) as nws by server
| eval firewall=if(nws="fw-".network OR match(network,"^fw-"), "yes", "no")
| fields - nws
| table server network firewall

Depending on the subleties of your data, you may need to tweak the eval firewall statement  

View solution in original post

LearningGuy
Motivator

Hi @bowesmana 
Thanks a lot!!  You rock!!  
I did make attempt on using evenstats, but then It didn't work because of  if condition didn't work.  It turns out I had to use a match command.   
I appreciate your help.

bowesmana
SplunkTrust
SplunkTrust

There are a number of ways to do this - the example below uses makeresults to create your example data 

Simple way 1 - use eventstats to collect all networks for each server and then check if the results contain fw-network-X where X is the network the server is on

| makeresults format=csv data="server,network,firewall
server-1,network-1,yes
server-1,fw-network-1,yes
server-2,network-2,no
server-3,network-1,yes
server-3,fw-network-1,yes
server-4,network-2,no
server-5,network-3,yes
server-5,fw-network-3,yes"
| fields - firewall
``` Above creates your example table ```
| eventstats values(network) as nws by server
| eval firewall=if(nws="fw-".network OR match(network,"^fw-"), "yes", "no")
| fields - nws
| table server network firewall

Depending on the subleties of your data, you may need to tweak the eval firewall statement  

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...