Splunk Search

Convert numbers to string

chamil3001
Explorer

Hi,

My search formula returns a value in number. I want to check that number and if the number is below 50 a Word should be displayed as "Okay" and if not (number>50) word should be displayed as "Check".

heres my fomula

host="HOST01" source=WMI:memory OR source="WMI:CPUTime" OR sourcetype="WMI:FreeDiskSpace" NOT Name=_Total | stats max(AvailableMBytes) as maxAvailableMBytes max(PercentProcessorTime) as maxPercentProcessorTime max(PercentFreeSpace) as maxPercentFreeSpace | eval maxUsedRAM = round(((4096-maxAvailableMBytes)*100)/4096, 0) | eval maxUsedSpace = round(100-maxPercentFreeSpace, 0) | eval intMax = if(if(maxUsedRAM>maxPercentProcessorTime,maxUsedRAM,maxPercentProcessorTime)>maxPercentFreeSpace, if(maxUsedRAM>maxPercentProcessorTime, maxUsedRAM, maxPercentProcessorTime),maxPercentFreeSpace) | table intMax

Thanks in advance

Chamil

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

chamil3001
Explorer

Yup.. got it to work. Thanks Martin,

0 Karma

chamil3001
Explorer

hmmm.. i can use the eval to get the two desired values, i haven't actually tried it.
thanks Martin

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...