Comparison of Field values

[macadminrohit]

I have a JSON which has something like this "Current Free Space","value":"240 KB", i am parsing out the field name which is "Current Free Space" and has the value 240 and the unit is KB, the possible unit can be B,KB,MB,GB .

I have a REGEX which is rex "\"Current Free Space\",\"value\":\"(?\d*.\d*)\s(?\w*)\"}"

I want to write a query which actually displays the count of devices which have "Current Free Space" less than 10GB.

Currently the fields freeSpaceAmount freeSpaceMeasure are different.

[adonio · Accepted solution]

hello there,

try this search anywhere:

| makeresults count=1
| eval "Current Free Space" = "100 GB, 10 KB, 1300 B, 14000 MB, 1 TB"
| makemv delim="," "Current Free Space"
| mvexpand "Current Free Space"
| rex field="Current Free Space" "(?<Value>\d+)\s+(?<Unit>\w*)$" 
| eval factor=case(Unit="B",1,Unit="KB",1024,Unit="MB",1024*1024,Unit="GB",1024*1024*1024,Unit="TB",11024*1024*1024*1024,true(),1)
| eval InBytes=Value*factor 
| eval in_GB = round(InBytes/1024/1024/1024, 3)

you can set the rules of less than 10 gb or any other rule as you like

hope it helps

[macadminrohit]

I understood everything except true(),1

[adonio]

from docs:
The following example shows how to use the true() function to provide a default to the case function.
... | eval error=case(status == 200, "OK", status == 404, "Not found", true(), "Other")