topic Help on if condition in eval in Installation

Help on if condition in eval

jip31 — Mon, 24 Dec 2018 06:44:37 GMT

I use the query below

index="perfmon-fr" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" 
| dedup host 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " MB" 
| rename Value as Free_Space 
| eval Free_Space= if(Free_Space>15, "GOOD", "BAD") 
| table Free_Space

But I have always a "BAD" result even if Free_Space < 15
What is the problem please??

Re: Help on if condition in eval

renjith_nair — Mon, 24 Dec 2018 07:45:10 GMT

@jip31,

| eval Value = round(Value, 1). " %" will result in Value% , for e.g. 80% and then you are doing a numerical comparison against that which is always false.

Try

 | eval Value = round(Value, 1)
 | eval TotalSpace = TotalSpaceKB/1024 
 | eval TotalSpace = round(TotalSpace/1024,1). " MB" 
 | rename Value as Free_Space 
 | eval Free_Space= if(Free_Space>15, "GOOD", "BAD") 
 | table Free_Space

or even simpler

  | eval TotalSpace = TotalSpaceKB/1024 
  | eval TotalSpace = round(TotalSpace/1024,1). " MB" 
  | eval Free_Space = if(Value>15, "GOOD", "BAD")

Re: Help on if condition in eval

jip31 — Mon, 24 Dec 2018 09:22:13 GMT

perfect thanks renjith