Conditional find and replace

willemjongeneel — Wed, 30 Sep 2020 01:30:37 GMT

Hello,

I have a question on a conditional find and replace. I have a query that calculates a mean for the different hours on the different days. This query looks like this:

index=index1 adapter_name=ABSAdapter earliest=-90d
| timechart span="1h" sum(number_of_records) as aantal
| eval time=strftime(_time,"%w%H")
| eventstats mean(aantal) as meanAantal, stdev(aantal) as stdAantal by time
| where (aantal>(meanAantal + (stdAantal * -3)) AND aantal<(meanAantal + (stdAantal * 3)))
| stats mean(aantal) as threshold by time
| eventstats mean(threshold) as overalMean
| table threshold, time, overalMean

Now I also want to find and replace threshold values that are under a certain value to 0. The condition should be something like:

if(threshold < overalMean*0.20) --> threshold = 0
else --> threshold = threshold

Does anyone know how to do this?

Thanks in advance and kind regards,
Willem

Re: Conditional find and replace

willemjongeneel — Wed, 30 Sep 2020 01:30:39 GMT

I got this working just after I asked the question...

Solution: | eval threshold=case(threshold < overalMean*0.05, 0, threshold > overalMean*0.05, threshold)

Re: Conditional find and replace

willemjongeneel — Wed, 30 Sep 2020 01:30:42 GMT

I got this working just after I asked the question...

Solution: | eval threshold=case(threshold < overalMean*0.05, 0, threshold > overalMean*0.05, threshold)

topic Conditional find and replace in Splunk Search

Conditional find and replace

Re: Conditional find and replace

Re: Conditional find and replace