topic Re: Can you help me compare the numerical values of fields? in Splunk Search

Can you help me compare the numerical values of fields?

sgoodman26 — Tue, 29 Sep 2020 22:55:50 GMT

My company gets a log file that we are trying to compare a set of numbers to one another. These numbers have to be within ten digits of one another, otherwise we need to be alerted on this. I've been able to Extract both of these numbers into fields (last_applied and last_received), and I am trying to run a search that compares the two, but ONLY alerts when they are over 10 digits away form each other. Been trying to use the diff function, but am a bit stuck on which eval or other functions that would be appropriate.

This is what I have so far:

index="mail" host="outlook.office365.com" last_applied=* last_received=* | diff attribute=last_applied attribute=last_received

Any help would be greatly appreciated.

Re: Can you help me compare the numerical values of fields?

HiroshiSatoh — Fri, 25 Jan 2019 00:24:43 GMT

I do not know "over 10 digits". Can you write an example?

Re: Can you help me compare the numerical values of fields?

somesoni2 — Fri, 25 Jan 2019 01:38:24 GMT

Are you looking for something like this?
*Updated *

    index="mail" host="outlook.office365.com" last_applied=* last_received=* | eval diff=abs(last_applied-last_received)
| where diff>10

Re: Can you help me compare the numerical values of fields?

sgoodman26 — Fri, 25 Jan 2019 15:35:58 GMT

If Last Applied = 3100 and Last Received =3110, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 2990, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 3111, this would be outside of 10 of each other.

Re: Can you help me compare the numerical values of fields?

woodcock — Fri, 25 Jan 2019 17:40:46 GMT

Like this:

index="mail" host="outlook.office365.com" last_applied=* last_received=*
| where abs(last_applied - last_received) >= 10