topic Re: Convert numbers to string in Splunk Search

Convert numbers to string

chamil3001 — Mon, 25 Mar 2013 06:01:59 GMT

Hi,

My search formula returns a value in number. I want to check that number and if the number is below 50 a Word should be displayed as "Okay" and if not (number>50) word should be displayed as "Check".

heres my fomula

host="HOST01" source=WMI:memory OR source="WMI:CPUTime" OR sourcetype="WMI:FreeDiskSpace" NOT Name=_Total | stats max(AvailableMBytes) as maxAvailableMBytes max(PercentProcessorTime) as maxPercentProcessorTime max(PercentFreeSpace) as maxPercentFreeSpace | eval maxUsedRAM = round(((4096-maxAvailableMBytes)*100)/4096, 0) | eval maxUsedSpace = round(100-maxPercentFreeSpace, 0) | eval intMax = if(if(maxUsedRAM>maxPercentProcessorTime,maxUsedRAM,maxPercentProcessorTime)>maxPercentFreeSpace, if(maxUsedRAM>maxPercentProcessorTime, maxUsedRAM, maxPercentProcessorTime),maxPercentFreeSpace) | table intMax

Thanks in advance

Chamil

Re: Convert numbers to string

martin_mueller — Mon, 25 Mar 2013 08:19:09 GMT

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

Re: Convert numbers to string

chamil3001 — Mon, 25 Mar 2013 08:46:20 GMT

hmmm.. i can use the eval to get the two desired values, i haven't actually tried it.
thanks Martin

Re: Convert numbers to string

chamil3001 — Tue, 26 Mar 2013 03:09:16 GMT

Yup.. got it to work. Thanks Martin,