topic Re: How to compare 2 values from Same field? in Alerting

How to compare 2 values from Same field?

samjoshiacademi — Thu, 02 Jan 2020 12:28:41 GMT

I am having one field and it has 2 values. Comparing them with each other I want to generate a message whether "Success" or "Failure".
Below are details:

// Search
| table _time, ErrorCount | sort 2 _time

It gives me result like

         _time                           ErrorCount
       2-Jan-20 16:35:00                  10
       2-Jan-20 16:34:00                  14

I want to show "Success" if ErrorCount at latestTime < ErrorCount at earliestTime and failure if its otherwise.

Re: How to compare 2 values from Same field?

jpolvino — Thu, 02 Jan 2020 13:19:47 GMT

Here is one way to do it:

| makeresults 
| eval data="2-Jan-20 16:35:00,10;
2-Jan-20 16:34:00,14"
| makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim=","
| eval _time=strptime(mvindex(data,0),"%d-%b-%y %H:%M:%S"),
     ErrorCount=mvindex(data,1)
| fields _time ErrorCount
| autoregress ErrorCount p=1
| eval status=case(ErrorCount<ErrorCount_p1,"Success",ErrorCount>=ErrorCount_p1,"Failure",1==1,null())
| fields - ErrorCount_p1

This uses autoregress to allow comparison with earlier rows.

Re: How to compare 2 values from Same field?

samjoshiacademi — Thu, 09 Jan 2020 15:59:50 GMT

Thanks:) worked swiftly