Splunk Search

Grouping fields in a search: How do I apply conditional logic to the results to assign new values?

katzr
Path Finder

I have a table that has UserID, device, and classification (1,2,3). A UserID can have multiple devices and a device can have multiple UserIDs. As of now, the row of data has a classification based on other factors for each row containing a device and UserID.

This means a userID may have many different classifications for each of their devices. I want to change the classification for each user to the highest classification. For example: a UserID has 4 devices with a classification of 1,2,2,3. I want to change the classification for each of these to 3 because that is the max of the classification for that UserID.

I need help with the logic of this and how I can group the UserID to find the number of devices per UserID and then use if statements to change the classification?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Do you want every row for each user updated to have the highest classification on any row? or are you just wanting a search that brings back the highest classification for each user?

This gives you a single record for each UserID, with a list of their devices, and the highest classification

your search that brings UserID, device, classification
| stats list(device) as device max(classification) as classification by UserID

This gives you each record that you currently have, marked with the highest classification that user has.

your search that brings UserID, device, classification
 | eventstats max(classification) as classification by UserID

This gives you one record for each combination of userID and device, marked with the highest classification that user has.

your search that brings UserID, device, classification
 | eventstats max(classification) as maxclass by UserID
 | stats max(maxclass) as classification by UserID device  
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...