Splunk Search

Is there a way where I can tag events and add another field based on hierarchy?

patricianaguit
Explorer

is there a way where I can tag events and add another field based on hierarchy?

For example:

Id 1 has different initial tags (A,B,C, and D) since A is the highest, the final tag should be "A"

 ID   |                InitialTag               |  FinalTag
 1                        A                            A
 1                        B                            A
 1                        C                            A
 1                        D                            A

Tag Ranks:
A - 1st
B - 2nd
C -3rd
D - 4th

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi patricianaguit,

if InitialTag is a number you can use in the stats command the function max, e.g.

my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID

Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:

  Tag,Rank
  A,1
  B,2
  C,3
  D,4

and a search like this:

my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi patricianaguit,

if InitialTag is a number you can use in the stats command the function max, e.g.

my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID

Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:

  Tag,Rank
  A,1
  B,2
  C,3
  D,4

and a search like this:

my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID

Bye.
Giuseppe

0 Karma

patricianaguit
Explorer

thank you this worked for me!

0 Karma

koshyk
Super Champion

what's your logic to say A is the highest? (alphabetical order?)

0 Karma

493669
Super Champion

Try this:

|eventstats first(InitialTag) as FinalTag by ID
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...