Convert numbers to string

[chamil3001]

Hi,

My search formula returns a value in number. I want to check that number and if the number is below 50 a Word should be displayed as "Okay" and if not (number>50) word should be displayed as "Check".

heres my fomula

host="HOST01" source=WMI:memory OR source="WMI:CPUTime" OR sourcetype="WMI:FreeDiskSpace" NOT Name=_Total | stats max(AvailableMBytes) as maxAvailableMBytes max(PercentProcessorTime) as maxPercentProcessorTime max(PercentFreeSpace) as maxPercentFreeSpace | eval maxUsedRAM = round(((4096-maxAvailableMBytes)*100)/4096, 0) | eval maxUsedSpace = round(100-maxPercentFreeSpace, 0) | eval intMax = if(if(maxUsedRAM>maxPercentProcessorTime,maxUsedRAM,maxPercentProcessorTime)>maxPercentFreeSpace, if(maxUsedRAM>maxPercentProcessorTime, maxUsedRAM, maxPercentProcessorTime),maxPercentFreeSpace) | table intMax

Thanks in advance

Chamil

[martin_mueller · Accepted solution]

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

[chamil3001]

Yup.. got it to work. Thanks Martin,

[chamil3001]

hmmm.. i can use the eval to get the two desired values, i haven't actually tried it.
thanks Martin