Splunk Search

## Convert numbers to string

Explorer

Hi,

My search formula returns a value in number. I want to check that number and if the number is below 50 a Word should be displayed as "Okay" and if not (number>50) word should be displayed as "Check".

heres my fomula

host="HOST01" source=WMI:memory OR source="WMI:CPUTime" OR sourcetype="WMI:FreeDiskSpace" NOT Name=_Total | stats max(AvailableMBytes) as maxAvailableMBytes max(PercentProcessorTime) as maxPercentProcessorTime max(PercentFreeSpace) as maxPercentFreeSpace | eval maxUsedRAM = round(((4096-maxAvailableMBytes)*100)/4096, 0) | eval maxUsedSpace = round(100-maxPercentFreeSpace, 0) | eval intMax = if(if(maxUsedRAM>maxPercentProcessorTime,maxUsedRAM,maxPercentProcessorTime)>maxPercentFreeSpace, if(maxUsedRAM>maxPercentProcessorTime, maxUsedRAM, maxPercentProcessorTime),maxPercentFreeSpace) | table intMax

Thanks in advance

Chamil

Tags (4)
1 Solution
SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

Explorer

Yup.. got it to work. Thanks Martin,

Explorer

hmmm.. i can use the eval to get the two desired values, i haven't actually tried it.
thanks Martin

*NEW* Splunk Love Promo!
Snag a \$25 Visa Gift Card for Giving Your Review!

### It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a \$25 Visa gift card! Review: SOAR (f.k.a. Phantom) >> Enterprise Security >> Splunk Enterprise or Cloud for Security >> Observability >> Or Learn More in Our Blog >>

Get Updates on the Splunk Community!