Splunk Search

Command 'search' can't compare two floating numbers

thenhaque
Explorer

I am writing a saved search to trigger and alert when a difference between values is higher than a threshold. A simplified version of my search is as follows. This threshold is expected to be a floating point number, and Splunk can't do correct comparison:

| NOOP | stats count|eval var1=2.1|eval var2=2.0|search var1 > var2
==> No results found. Try expanding the time range.

| NOOP | stats count|eval var1=2.1|eval var2=2.0|search var1 < var2
==> count var1 var2
0 2.1 2.0

Did I do something incorrectly?

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

| NOOP | stats count|eval var1=2.1|eval var2=2.0|where var1 > var2

View solution in original post

thenhaque
Explorer

Thanks for all your quick answers. They all work perfectly. I should have posted the question sooner so that I didn't have to spend an hour scratching my head 🙂

0 Karma

mayurr98
SplunkTrust
SplunkTrust

Use where instead of search
Try this
| NOOP | stats count|eval var1=2.1|eval var2=2.0| where var1 > var2

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi thenhaque,

use where instead of search to compare field values:

| makeresults 
| stats count 
| eval var1=2.1 
| eval var2=2.0
| where var1 < var2

or

| makeresults 
| stats count 
| eval var1=2.1 
| eval var2=2.0
| where var1 > var2

Here is a bit more detail about where vs search commands https://answers.splunk.com/answers/50659/whats-the-difference-between-where-and-search-in-the-pipeli...

Hope this helps ...

cheers, MuS

thenhaque
Explorer

Thank you. This works wonderfully.

0 Karma

HiroshiSatoh
Champion

Try this!

| NOOP | stats count|eval var1=2.1|eval var2=2.0|where var1 > var2

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!