Splunk Search

Can you help me compare the numerical values of fields?

sgoodman26
Explorer

My company gets a log file that we are trying to compare a set of numbers to one another. These numbers have to be within ten digits of one another, otherwise we need to be alerted on this. I've been able to Extract both of these numbers into fields (last_applied and last_received), and I am trying to run a search that compares the two, but ONLY alerts when they are over 10 digits away form each other. Been trying to use the diff function, but am a bit stuck on which eval or other functions that would be appropriate.

This is what I have so far:

index="mail" host="outlook.office365.com" last_applied=* last_received=* | diff attribute=last_applied attribute=last_received

Any help would be greatly appreciated.

0 Karma

woodcock
Esteemed Legend

Like this:

index="mail" host="outlook.office365.com" last_applied=* last_received=*
| where abs(last_applied - last_received) >= 10
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you looking for something like this?
*Updated *

    index="mail" host="outlook.office365.com" last_applied=* last_received=* | eval diff=abs(last_applied-last_received)
| where diff>10
0 Karma

HiroshiSatoh
Champion

I do not know "over 10 digits". Can you write an example?

0 Karma

sgoodman26
Explorer

If Last Applied = 3100 and Last Received =3110, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 2990, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 3111, this would be outside of 10 of each other.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...