Lexicographic comparison of version strings?

waisbrot — Tue, 06 Aug 2013 17:50:08 GMT

I have version strings in my log output, and I'd like to filter on these, like

| where version < 2.3.5

But Splunk only wants to do numeric comparison with '<'. Is there an operator to perform lexicographic comparisons?

Re: Lexicographic comparison of version strings?

okrabbe_splunk — Wed, 28 May 2014 02:36:51 GMT

I am not aware of a function or command to do this.

However, you could use a more complicated where clause if we assume you have broken out the version into fields major, minor and point....

|where major > 2 OR (major >=2 AND minor >3) OR (major >=2 AND minor >= 2 AND point > 5)