How can we use spath for below JSON to evaluate if for ConcurrentAsyncGetReportInstances , Remaining/Max*100 is >= 70%? Coul any one please help?
{
"AnalyticsExternalDataSizeMB":{
"Max":478600,
"Remaining":40960
},
"ConcurrentAsyncGetReportInstances":{
"Max":400,
"Remaining":200
},
"ConcurrentEinsteinDataInsightsStoryCreation":{
"Max":5,
"Remaining":5
},
"ConcurrentEinsteinDiscoveryStoryCreation":{
"Max":2,
"Remaining":2
},
"ConcurrentSyncReportRuns":{
"Max":20,
"Remaining":20
},
"DailyAnalyticsDataflowJobExecutions":{
"Max":60,
"Remaining":60
},
"DailyAnalyticsUploadedFilesSizeMB":{
"Max":51200,
"Remaining":51200
},
your search
| spath
| eval perc = ('ConcurrentAsyncGetReportInstances{}.Max' / 'ConcurrentAsyncGetReportInstances{}.Remaining' * 100)
| where perc >= 70
This search query is running but there are no results. upon removing: | where perc >= 70 , i see the normal search result that i was getting earlier in the form of JSON and nothing new in the left panel(Selected Fields or Interesting Fields)
nothing new
your sample is wrong. These are multivalues, aren't you?
the sample is correct and I achieved it via regular expressions : ConcurrentSyncReportRuns\':\s{\'Max':\s(?\d+)\,\s'Remaining':\s(?\d+),
If you use rex
, what's problem?
use eval
to calculate.