I have results with field names A, B, C, D that will look something like this;
A B C D
0 10 0 0
1 0 4 5
0 3 8 0
0 0 0 2
I'm looking for some type of eval
that will give me a true or false as to whether the fields have only ONE value that is non-zero. So in this case the first row (0, 10, 0, 0) and the last row (0, 0, 0, 2) are true and the other two are false.
I could test every permutation, but that seems inefficient. Is there a better way?
I think this will do it if you can put the fields into a single string called "foo", but it's untested.
... | rex field=foo max_match=0 "(?P<zeroes>^0| 0)" | eval onlyOne=if(mvcount(zeroes)==3, "true", "false") | ...