Splunk Search

Convert numbers to string

chamil3001
Explorer

Hi,

My search formula returns a value in number. I want to check that number and if the number is below 50 a Word should be displayed as "Okay" and if not (number>50) word should be displayed as "Check".

heres my fomula

host="HOST01" source=WMI:memory OR source="WMI:CPUTime" OR sourcetype="WMI:FreeDiskSpace" NOT Name=_Total | stats max(AvailableMBytes) as maxAvailableMBytes max(PercentProcessorTime) as maxPercentProcessorTime max(PercentFreeSpace) as maxPercentFreeSpace | eval maxUsedRAM = round(((4096-maxAvailableMBytes)*100)/4096, 0) | eval maxUsedSpace = round(100-maxPercentFreeSpace, 0) | eval intMax = if(if(maxUsedRAM>maxPercentProcessorTime,maxUsedRAM,maxPercentProcessorTime)>maxPercentFreeSpace, if(maxUsedRAM>maxPercentProcessorTime, maxUsedRAM, maxPercentProcessorTime),maxPercentFreeSpace) | table intMax

Thanks in advance

Chamil

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

A more general note - if you're looking for the maximum of free space or memory you cannot deduct this from the total to get the maximum used space or memory. You'd have to look for the minimum free to get the maximum used.

As for finding the maximum of three fields, you can use the eval function max() instead of a cascaded if.

Concerning your actual question, what's wrong with eval result = if(value < 50, "Okay", "Check")?

chamil3001
Explorer

Yup.. got it to work. Thanks Martin,

0 Karma

chamil3001
Explorer

hmmm.. i can use the eval to get the two desired values, i haven't actually tried it.
thanks Martin

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...