About AbhishekJ

AbhishekJ · ‎10-20-2022

Thanks, this works like the way I was hoping it for: index=my_data |eval ChkMgrID=MgrID |join type=outer left=L right=R where L.ChkMgrID = R.ID [search index=my_data | eval MgrName=Name | fields ID MgrName] | table L.ID L.Name L.MgrID R.MgrName I would further modify it to get 3 levels of leadership in the organisation, but this is something I was looking for.

AbhishekJ · ‎10-20-2022

Thanks, tried like below 😞 , but didn't work 😞 index=my_data |eval ChkMgrID=MgrID |join type=outer left=L right=R where L.ChkMgrID = R.ID [search index=my_data | eval MgrName=Name | table MgrName] | table ID Name MgrID MgrName Time range last 24 hours , reading about join as well .

AbhishekJ · ‎10-19-2022

Thanks, using lookups does make sense, may be I would use a KV Store as I am handling 300000 entries. I will give it a try in Dev env to see how it works out and confirm. Any suggestions, if this could this be done with using Subsearch/join/appendcols/macros somehow.

AbhishekJ · ‎10-19-2022

Thanks, its in the same index , was trying to see if there was a way I could use something like subsearches/macros/join or some other way to produce required result in a single SPL: ID Name MgrID 1 Tom 4 2 Rick 1 3 Harry 1 4 Boss 5 5 CEO 5

AbhishekJ · ‎10-19-2022

The data is the same , I need to populate the results from this index by requiring it. ID is the unique field and since the primary data contains the ID of the Manager, I need to populate the final results with Mgr Name by utilising the Mgr ID. Thanks

AbhishekJ · ‎10-19-2022

Thanks, The Data is in use for Identity management , I was hoping to get a logic that I can further modify and implement with my actual data.

AbhishekJ · ‎10-19-2022

Hi, I have set of events from an index with user details as below and I am looking to populate the events with there manager Name . ID Name MgrID 1 Tom 4 2 Rick 1 3 Harry 1 4 Boss 5 5 CEO 5 I want to add another column to the result with MgrName like below using the MgrID and re-referencing the same index again: ID Name MgrID MgrName 1 Tom 4 Boss 2 Rick 1 Tom 3 Harry 1 Tom 4 Boss 5 CEO 5 CEO 5 CEO Tried to come up with something and so far no luck, appreciate if someone has any suggestions or have done this before. Thanks

Posts	7
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-19-2022

Online Status	Offline
Date Last Visited	‎10-20-2022 09:25 PM

How can I populate an event with data from another...

Re: Populate an event with data from another event

Re: Populate an event with data from another event

Re: Populate an event with data from another event

Re: Populate an event with data from another event

Re: Populate an event with data from another event

Re: Populate an event with data from another event

How can I populate an event with data from another...

Are you a member of the Splunk Community?