Splunk Search

Can I table the output on conditional basis?

ppanchal
Path Finder

index=adjusted| eval Variance=TOTAL_PAID_DRVR_MINUTE_CNT-PLAN_PAID_DRVR_MINUTE_CNT|eval test=if(Variance>=120,[search index=adjusted|return $test],"")||table MA_NM,SITE_CD,SITE_NM,PRMRY_SUB_TYPE_LOB_NM,PE_LOB_NM,SUB_LOB_DESC,RTE_NUM,RTE_EXECUTION_SVC_DT,DEPART_SITE_DTM,ARRIVE_SITE_DTM,TOTAL_PAID_DRVR_MINUTE_CNT,PLAN_PAID_DRVR_MINUTE_CNT,EXCPTN_REASON_DESC,STATUSCODE,STATUSDATE,Variance

Above is my search query.

I want the table the results only when Variance is >=120.

Any suggestions?

Tags (1)
0 Karma

poete
Builder

Hello,

do you wat to dislay only the rows where Variance>=120, or to display the whole table only if at least one row contains Variance>=120?

In the first case, a where close is enough before |table, on the second case, conditional display of panels sould do the trick

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...