Splunk Enterprise

How to get the data when conditions applied?

mahesh27
Communicator

Search:

index=xxxxx   host_ip IN(16.121.12.123 OR 16.121.12.124  OR 16.121.12.126 OR 16.121.12.128) sourcetype=xxxxxxx
|search "activity_status"=done
|eval results=if((like(response, "200"), "success", "failure")
|stats count(eval(result="success")) AS Overall_Success, count(response) as total
|eval Success_per=(Overall_Success/total)*100.0
|stats avg(Success_per) as SuccessPer



how can i write the condition like when my SuccessPer is <40  i need to see message like "The application is less thank 40 %, please check."
If the SuccessPer is >40 then SuccessPer value should display.

How can i do this???

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval message=if(Success_per < 40,"The application is less thank 40 %, please check.", null())

rafiki31
Engager

Hi,

This ?

| eval Success_per=if(Success_per<40, "The application is less thank 40 %, please check.", Success_per)

 

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...