Splunk Search

How do I write an eval statement to return "True" if there is only one non-zero value in a row, else "False"?

lynchs61
New Member

I have results with field names A, B, C, D that will look something like this;

A    B    C    D
0    10   0    0
1    0    4    5
0    3    8    0
0    0    0    2

I'm looking for some type of eval that will give me a true or false as to whether the fields have only ONE value that is non-zero. So in this case the first row (0, 10, 0, 0) and the last row (0, 0, 0, 2) are true and the other two are false.

I could test every permutation, but that seems inefficient. Is there a better way?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this will do it if you can put the fields into a single string called "foo", but it's untested.

... | rex field=foo max_match=0 "(?P<zeroes>^0| 0)" | eval onlyOne=if(mvcount(zeroes)==3, "true", "false") | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...