Splunk Search

Comparing two fields with > operator

srw46
Path Finder

Hello,

I am trying to compare two fields with a simple operator but it does not seem to perform as expected. I am simply trying to return any transaction times that are over the value of the 'threshold' field. This is what I'm trying:

time_taken>threshold

I have found another way around this by using the eval command:

eval over=time_taken-threshold | search over>0

This essentially does the same thing in a very round about way but it less than neat.

Is there something i'm missing to compare field to another field? I have scoured documention but can't find any examples of this.

Thanks in advance

Tags (2)
1 Solution

Lowell
Super Champion

I think you want to use where and not search. The where search operation lets you compare variables or even eval expressions, but search only looks for literal values. Here's an example.

  1. This search is looking for a field named "user" that contains the value of "login":

    | search user=login

  2. This search is looking for a field named "user" that contains the same value as the field named "login":

    | where user=login


So you should be able to take your example search expression:

| eval over=time_taken-threshold | search over>0

And change it to either:

| where (time_taken-threshold)>0

Or

| where time_taken>threshold

View solution in original post

Lowell
Super Champion

I think you want to use where and not search. The where search operation lets you compare variables or even eval expressions, but search only looks for literal values. Here's an example.

  1. This search is looking for a field named "user" that contains the value of "login":

    | search user=login

  2. This search is looking for a field named "user" that contains the same value as the field named "login":

    | where user=login


So you should be able to take your example search expression:

| eval over=time_taken-threshold | search over>0

And change it to either:

| where (time_taken-threshold)>0

Or

| where time_taken>threshold

srw46
Path Finder

Splendid.

Thank you again Lowell.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...