If then else compares

daniel333 — Wed, 20 Mar 2013 17:24:30 GMT

All,

I need to compare the results of two different searches and I am lost.

Something like this.
count( search status=success) < count (search status=error) then alarm.

How do I get the value of two searches and run a compare?

Re: If then else compares

lguinn2 — Wed, 20 Mar 2013 18:46:00 GMT

Try this:

sourcetype=xyz or whatever
| stats count(eval(status="success")) as successCount count(eval(status="error")) as ErrorCount

and use a custom condition for your alarm: errorCount >= successCount

However, the above will only work if the basic search on the first line is the same for both successes and errors. Also, the eval function is case-sensitive, so make sure that the values success/error are actually lower-case.

What if your successes are recorded in one log file but errors come from a different source? Here's a solution when the two base searches are different. It isn't as efficient, though:

sourcetype=abc status=success
| stats count as successCount
| appendcols [ search sourcetype=xyz status=error
    | addinfo | where _time >= info_min_time AND _time <= info_max_time
    | status count as errorCount ]

And you would use exactly the same custom condition: errorCount >= successCount

What is all that addinfo and other stuff? Well, the second solution uses a subsearch. The subsearch will run over all time unless you provide a time range. The addinfo and where commands retrieve the time range of the first search and apply it to the subsearch.

Hope this helps!

Re: If then else compares

lguinn2 — Wed, 20 Mar 2013 18:46:37 GMT

BTW, nicely explained. Unless I completely misunderstood it, of course!

topic Re: If then else compares in Splunk Search

If then else compares

Re: If then else compares

Re: If then else compares