topic Re: How would you use if in this situation? in Splunk Dev

How would you use if in this situation?

taehe — Mon, 05 Sep 2022 05:52:59 GMT

| eval err=if(data>80,code,"")

I am composing spl using if statement. If the data value is over 80, a code is generated. However, if the value of 80 or more is maintained, a code is generated only at the starting value of 80 or more, and the code does not occur until it falls below 80. What should I do?

Re: How would you use if in this situation?

ITWhisperer — Mon, 05 Sep 2022 05:58:29 GMT

| streamstats window=1 current=f latest(data) as previous_data | eval err=if(data>80 AND previous_data <= 80, code, "")

Re: How would you use if in this situation?

taehe — Tue, 06 Sep 2022 02:39:45 GMT

thanks for good answer

However, if the current SPL is used, the code does not start at the value above 80, but the code occurs before when it becomes less than 80. Can this be solved? Since the data is different based on the car, the current spl is as follows.

| streamstats window=2 current=f earliest(data) as previous_data by car | eval err=if(data>80 AND previous_data <=80, code, "")

Re: How would you use if in this situation?

ITWhisperer — Tue, 06 Sep 2022 09:05:53 GMT

| streamstats window=1 current=f global=f earliest(data) as previous_data by car | eval err=if(data>80 AND (isnull(previous_data) OR previous_data <=80), code, "")