topic Re: Define a field and get an integer value in Splunk Search

Define a field and get an integer value

dnikam — Mon, 10 Jul 2023 23:19:05 GMT

Hello,

I have a log file that do not conform to the log4j standards.

The log file entry is as

Some text before. Mem=500/300

I would like to write a script and get value of Field1=500 and Field2=300.

Then compute Field1 and Field2 (For. e.g Field2/Field1 > 0.8), then trigger an alert.

Appreciate any help on how this can be achieved.

Thanks,

Re: Define a field and get an integer value

richgalloway — Tue, 11 Jul 2023 00:13:52 GMT

No script is necessary. It can be done within your query like this

... | rex "Mem=(?<Field1>\d+)\/(?<Field2>\d+)" | eval ratio=exact(Field2/Field1) | where ratio>0.8

Have the alert trigger when the number of results is not zero.

Re: Define a field and get an integer value

GaetanVP — Tue, 11 Jul 2023 11:57:45 GMT

Hello @dnikam,

You could try the following :

If you run this search, it will display an event only if the ratio is actually above 0.8

You can simply click on the "save as" button, choose alert and complete the other info, be sure to trigger the alert when the number of results is greater than zero, and select the correct schedule time, for instance :

Hope it helps !
GaetanVP