Splunk Search

Command 'search' can't compare two floating numbers

thenhaque
Explorer

I am writing a saved search to trigger and alert when a difference between values is higher than a threshold. A simplified version of my search is as follows. This threshold is expected to be a floating point number, and Splunk can't do correct comparison:

| NOOP | stats count|eval var1=2.1|eval var2=2.0|search var1 > var2
==> No results found. Try expanding the time range.

| NOOP | stats count|eval var1=2.1|eval var2=2.0|search var1 < var2
==> count var1 var2
0 2.1 2.0

Did I do something incorrectly?

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

| NOOP | stats count|eval var1=2.1|eval var2=2.0|where var1 > var2

View solution in original post

thenhaque
Explorer

Thanks for all your quick answers. They all work perfectly. I should have posted the question sooner so that I didn't have to spend an hour scratching my head 🙂

0 Karma

mayurr98
Super Champion

Use where instead of search
Try this
| NOOP | stats count|eval var1=2.1|eval var2=2.0| where var1 > var2

0 Karma

MuS
Legend

Hi thenhaque,

use where instead of search to compare field values:

| makeresults 
| stats count 
| eval var1=2.1 
| eval var2=2.0
| where var1 < var2

or

| makeresults 
| stats count 
| eval var1=2.1 
| eval var2=2.0
| where var1 > var2

Here is a bit more detail about where vs search commands https://answers.splunk.com/answers/50659/whats-the-difference-between-where-and-search-in-the-pipeli...

Hope this helps ...

cheers, MuS

thenhaque
Explorer

Thank you. This works wonderfully.

0 Karma

HiroshiSatoh
Champion

Try this!

| NOOP | stats count|eval var1=2.1|eval var2=2.0|where var1 > var2
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...