topic Re: Passing comparison operators in a variable in Splunk Search

Passing comparison operators in a variable

ohbuckeyeio — Mon, 06 Apr 2020 22:35:37 GMT

Is there a way to dynamically pass a comparison operator as a variable without a macro? I am looking to achieve something similar to what is shown below.

| eval number=8
| eval operator=">="
| eval comparison=7
| eval validate=if(number.operator.comparison,"yep","nope")

Re: Passing comparison operators in a variable

martin_mueller — Mon, 06 Apr 2020 22:44:53 GMT

There are only ugly options, e.g. iterating through all operators with case(), or map. What are you trying to achieve?

Re: Passing comparison operators in a variable

ohbuckeyeio — Mon, 06 Apr 2020 22:54:44 GMT

Hi Martin. I have a kvstore with rows that have a numerical field and an operator field (among others). I would like to loop through those rows and build a dynamic comparison based off of some search results.

In the example above, the field "number" is from an indexed search. The operator and comparison fields are in the kvstore. I would like to be able to dynamically compare the number/comparison fields based on the provided operator value.

The operators could be any standard operator (=,!=,>=, etc...)

Re: Passing comparison operators in a variable

martin_mueller — Mon, 06 Apr 2020 23:09:13 GMT

Considering there only are six common comparison operators = != < <= > >= I'd recommend creating a macro that houses a big case statement.

Re: Passing comparison operators in a variable

ohbuckeyeio — Tue, 07 Apr 2020 13:51:28 GMT

Thank you Martin. I was assuming this would be the answer but was hoping for something more concise. I appreciate the help.