topic Eval Equals Another Field in Splunk Search

Eval Equals Another Field

cquinney — Tue, 29 Sep 2020 23:33:38 GMT

Greetings,

I have a query that ends with a timechart command

| timechart span=1h eval(round(avg(FIELD),0)) as "Response" by source_type

Previously, I created thresholds for my timechart by using eval

| eval Normal = 500
| eval High = 1000

However, as my number of source_types grew, I could no longer utilize the same thresholds. I've created a lookup that contains the necessary thresholds for each specific source_type, and I can see the new field created in the fields column on the left hand side of the screen. However, I'm having trouble adding this new field or setting this new field as its intended threshold delimiter.

So how can create a timechart (which I have to keep/utilize) and incorporate my thresholds from my lookup?

The final output would look similar to this:

_time              Source_Type     Normal          High
3/3/19             ABC               500             1000

Any help is greatly appreciated.

Re: Eval Equals Another Field

woodcock — Tue, 05 Mar 2019 03:26:24 GMT

Like this:

... | timechart span=1h eval(round(avg(FIELD),0)) AS Response BY Source_Type
| untable _time sourcetype count
| lookup MyThresholdLookup Source_Type
...

Re: Eval Equals Another Field

cquinney — Tue, 05 Mar 2019 03:40:08 GMT

Thank you for suggestion but it didn't give the outcome I need. Do you know of a way to to create a new field based on another field or from the lookup?

| eval Normal=Lookup.csv Normal

Re: Eval Equals Another Field

woodcock — Tue, 05 Mar 2019 03:50:18 GMT

Let's start over. Show me:
1: A few raw events
2: Your full search (all of it)
3: Your current output
4: The first 2 lines of your Lookup.csv file
5: A mockup of your desired output