topic Re: How do divide greater than and less than in splunk? in Splunk Search

How do divide greater than and less than in splunk?

sagar1905 — Sat, 16 Dec 2017 18:58:10 GMT

I'm trying to divide my query into two parts, D>8000 as X and D<=8000 as Y, so i put it .... my search | eval count(if(D<=8000)) AS Y, count(if(D>8000)) AS X | transpose.................... but its not working. How do I divide it?

Re: How do divide greater than and less than in splunk?

richgalloway — Sat, 16 Dec 2017 23:18:40 GMT

What does "it's not working" mean? What do you get for X and Y?

Re: How do divide greater than and less than in splunk?

mayurr98 — Sun, 17 Dec 2017 00:54:09 GMT

Hey @sagar1905

Try this

.... my search | eval divide=case(D<=8000,”Y”,D>8000,”X”) | stats count by divide

Let me know if this helps!

Re: How do divide greater than and less than in splunk?

cmerriman — Sun, 17 Dec 2017 04:38:25 GMT

Do you want these as separate fields or as one field with two values?

To create one field with two values:

...| eval two_parts=if(D<=8000,”Y”,”X”)...

To get separate fields:

...|eval Y=if(D<=8000,D,null())|eval X=if(D>8000,D,null())...

Re: How do divide greater than and less than in splunk?

micahkemp — Sun, 17 Dec 2017 04:51:21 GMT

The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:

stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X

Re: How do divide greater than and less than in splunk?

sagar1905 — Sun, 17 Dec 2017 23:40:55 GMT

Hey @mayurr98, it didn't work.
I got the following error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '”Y”,D>8000,”X”)'.

Re: How do divide greater than and less than in splunk?

sagar1905 — Sun, 17 Dec 2017 23:43:57 GMT

Thanks micahkemp, this works. So I should have used eval instead of if.

Re: How do divide greater than and less than in splunk?

mayurr98 — Mon, 18 Dec 2017 04:46:59 GMT

Try this
.... my search | eval divide=if(D<=8000,”Y”,”X”) | stats count by divide