topic Re: How to control values of a field relative to the values in the _time field in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174877#M50179 <P>thank you!</P> Fri, 08 May 2015 01:39:24 GMT HattrickNZ 2015-05-08T01:39:24Z How to control values of a field relative to the values in the _time field https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174875#M50177 <P>I have this search, and this at least gives me some output but not as I would like. </P> <P><CODE>index=_internal sourcetype="splunk_web_access" | timechart count(uri) | eval test=if(_time&amp;lt;="2015-04-29",450,600)</CODE></P> <P>But what I want to do is be able to control the value of the <CODE>test</CODE> field relative to the <CODE>_time</CODE> field. <BR /> For instance, I would like <CODE>test</CODE> to be equal to 450 up to this date "2015-04-29" and then 600 afer that.<BR /> What is the corerct syntax to do this? </P> <P>The output of my data looks something like this: </P> <PRE><CODE>_time count(uri) test 2015-04-08 1 450 2015-04-09 1 450 2015-04-10 1 450 2015-04-11 0 450 </CODE></PRE> Fri, 08 May 2015 00:16:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174875#M50177 HattrickNZ 2015-05-08T00:16:55Z Re: How to control values of a field relative to the values in the _time field https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174876#M50178 <P>_time is actually a timestamp and not the %Y-%m-%d representation so if you do an </P> <PRE><CODE>eval tcheck=strptime("2015-04-29","%F") | eval test=if(_time&amp;lt;=tcheck,450,600) </CODE></PRE> <P>and that should work</P> Fri, 08 May 2015 00:52:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174876#M50178 ramdaspr 2015-05-08T00:52:17Z Re: How to control values of a field relative to the values in the _time field https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174877#M50179 <P>thank you!</P> Fri, 08 May 2015 01:39:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-values-of-a-field-relative-to-the-values-in-the/m-p/174877#M50179 HattrickNZ 2015-05-08T01:39:24Z