How to compare 2 values from Same field?

[samjoshiacademi]

I am having one field and it has 2 values. Comparing them with each other I want to generate a message whether "Success" or "Failure".
Below are details:

// Search
| table _time, ErrorCount | sort 2 _time

It gives me result like

         _time                           ErrorCount
       2-Jan-20 16:35:00                  10
       2-Jan-20 16:34:00                  14  

I want to show "Success" if ErrorCount at latestTime < ErrorCount at earliestTime and failure if its otherwise.

[jpolvino · Accepted solution]

Here is one way to do it:

| makeresults 
| eval data="2-Jan-20 16:35:00,10;
2-Jan-20 16:34:00,14"
| makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim=","
| eval _time=strptime(mvindex(data,0),"%d-%b-%y %H:%M:%S"),
     ErrorCount=mvindex(data,1)
| fields _time ErrorCount
| autoregress ErrorCount p=1
| eval status=case(ErrorCount<ErrorCount_p1,"Success",ErrorCount>=ErrorCount_p1,"Failure",1==1,null())
| fields - ErrorCount_p1

This uses autoregress to allow comparison with earlier rows.

[samjoshiacademi]

Thanks:) worked swiftly