Splunk Search

Can I table the output on conditional basis?

ppanchal
Path Finder

index=adjusted| eval Variance=TOTAL_PAID_DRVR_MINUTE_CNT-PLAN_PAID_DRVR_MINUTE_CNT|eval test=if(Variance>=120,[search index=adjusted|return $test],"")||table MA_NM,SITE_CD,SITE_NM,PRMRY_SUB_TYPE_LOB_NM,PE_LOB_NM,SUB_LOB_DESC,RTE_NUM,RTE_EXECUTION_SVC_DT,DEPART_SITE_DTM,ARRIVE_SITE_DTM,TOTAL_PAID_DRVR_MINUTE_CNT,PLAN_PAID_DRVR_MINUTE_CNT,EXCPTN_REASON_DESC,STATUSCODE,STATUSDATE,Variance

Above is my search query.

I want the table the results only when Variance is >=120.

Any suggestions?

Tags (1)
0 Karma

poete
Builder

Hello,

do you wat to dislay only the rows where Variance>=120, or to display the whole table only if at least one row contains Variance>=120?

In the first case, a where close is enough before |table, on the second case, conditional display of panels sould do the trick

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...