topic Re: Custom Condition in Splunk Search

Custom Condition

TiagoMatos — Mon, 09 Sep 2013 15:22:52 GMT

Hello, I have a table that returns with these fields: AvgLow and AvgLowNOW, but they appear many times, like this

AvgLow AvgLowNOW
a b
a b
a b
a b
a b

I need to create an alert for when AvgLowNOW is greater then AvgLow. But in custome search condition with "search AvgLowNOW>AvgLow", I catch no events. What can I do to solve this?

Thank you

Re: Custom Condition

wagnerbianchi — Mon, 09 Sep 2013 15:56:37 GMT

Try if() or case() eval functions
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Eval

hypothetical example:
index=appmgmt | eval x=if(status>=status_description,1,0) | table x

Re: Custom Condition

TiagoMatos — Mon, 09 Sep 2013 15:58:12 GMT

I'm Portuguese, but on my work place I don't have access to skype.

Re: Custom Condition

TiagoMatos — Mon, 09 Sep 2013 15:59:24 GMT

I tried this

search dedup AvgOut,AvgOutQNOW | where AvgOutQNOW>AvgOut

Re: Custom Condition

wagnerbianchi — Mon, 09 Sep 2013 16:02:21 GMT

Is that work? look the example I've just sent...

Re: Custom Condition

TiagoMatos — Mon, 09 Sep 2013 16:21:10 GMT

Ok thank you!

Re: Custom Condition

rturk — Tue, 10 Sep 2013 11:49:55 GMT

Hi Tiago,

From your comments in the other answer, it looks as though you're nearly there. The where function is definitely your friend.

<base search> | where AvgLow < AvgLowNOW

This will return all results where AvgLowNOW is greater than AvgLow (no need to dedup)

Reference:

where: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where