Splunk Dev

How would you use if in this situation?

taehe
Explorer
| eval err=if(data>80,code,"") 

I am composing spl using if statement. If the data value is over 80, a code is generated. However, if the value of 80 or more is maintained, a code is generated only at the starting value of 80 or more, and the code does not occur until it falls below 80. What should I do?

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats window=1 current=f global=f earliest(data) as previous_data by car
| eval err=if(data>80 AND (isnull(previous_data) OR previous_data <=80), code, "")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats window=1 current=f latest(data) as previous_data
| eval err=if(data>80 AND previous_data <= 80, code, "")

taehe
Explorer

thanks for good answer

taehe_0-1662431774063.png

However, if the current SPL is used, the code does not start at the value above 80, but the code occurs before when it becomes less than 80. Can this be solved? Since the data is different based on the car, the current spl is as follows.

| streamstats window=2 current=f earliest(data) as previous_data by car
| eval err=if(data>80 AND previous_data <=80, code, "")

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats window=1 current=f global=f earliest(data) as previous_data by car
| eval err=if(data>80 AND (isnull(previous_data) OR previous_data <=80), code, "")
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...