compared to a threshold whose value varies depending on the value of another field

myli12 — Thu, 14 Feb 2013 19:55:41 GMT

I am processing packets drop log events and want to have a report that contains only those events with nopktDrop>= threshold. I have the following from raw log data, with each row extracted from an event log message

time policy noPktDrop
time1 1 45
time2 2 50
time3 3 30
time4 2 36

The threshold for each policy is different, for example, threshold = 40, 30, and 40 for policy 1, 2, and 3, respectively in the above example. What I want to have is the following report:

time policy noPktDrop
time1 1 45
time2 2 50
time4 2 36

Any suggestion on how to generate such a report?

Re: compared to a threshold whose value varies depending on the value of another field

Ron_Naken — Fri, 15 Feb 2013 00:10:30 GMT

There are a number of options. If there are a large number of policy ids, or you will reuse the policy/threshold mappings in numerous searches, you might consider using a lookup to maintain the policy/threshold mappings. Otherwise, here is a simple way:

... | eval t = case(policy == 1, 45, policy == 2, 40, policy == 3, 40) | where noPktDrop >= t

topic compared to a threshold whose value varies depending on the value of another field in Splunk Search

compared to a threshold whose value varies depending on the value of another field

Re: compared to a threshold whose value varies depending on the value of another field