Splunk Search

How do I write an eval statement to return "True" if there is only one non-zero value in a row, else "False"?

lynchs61
New Member

I have results with field names A, B, C, D that will look something like this;

A    B    C    D
0    10   0    0
1    0    4    5
0    3    8    0
0    0    0    2

I'm looking for some type of eval that will give me a true or false as to whether the fields have only ONE value that is non-zero. So in this case the first row (0, 10, 0, 0) and the last row (0, 0, 0, 2) are true and the other two are false.

I could test every permutation, but that seems inefficient. Is there a better way?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this will do it if you can put the fields into a single string called "foo", but it's untested.

... | rex field=foo max_match=0 "(?P<zeroes>^0| 0)" | eval onlyOne=if(mvcount(zeroes)==3, "true", "false") | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...