topic Re: how can I use a string value to compare number? in Splunk Search

how can I use a string value to compare number?

pramit46 — Thu, 15 Dec 2016 18:32:58 GMT

I have a field with values > = != etc., and another field that determines threshold
Now I want to Compare the value of third field against the threshold field using the value of that (String) operator. How to achieve this?

for example:

Threshold (Num)|Value(Num)|Operator(String)
10|12|">"
10|7|"!="
10|4|"<"

I need to compare the values using respective operator values and determine if the threshold is breached.
Any clue?

Re: how can I use a string value to compare number?

somesoni2 — Thu, 15 Dec 2016 19:06:40 GMT

How about a big case statement which writes an expression for every possible operator (should be a finite list), like this

your current search with fields Threshold, Value, Operator 
| eval isBreached=case(Operator=">" AND Value>Threshold, "Yes", Operator="!=" AND Value!=Threshold,"Yes", Operator="<" AND Value<Threshold,"Yes", true(),"No") | rest of the search

Re: how can I use a string value to compare number?

pramit46 — Sun, 18 Dec 2016 05:45:48 GMT

Awesome. Thanks a million @somesoni2. This helps a lot 🙂
Really Appreciate this.