Convert string to number and compare

[Rialf1959]

Hello,
why this is not working ?

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" | where ReplicasA > 0 

I even tryied this:

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| eval n=tonumber(ReplicasA) | where n > 0

Thanks

[niketn]

[Updated Answer based on Sample JSON Data]

@Rialf1959, is this a single event or can an event have multiple such nodes? I am trying to understand as to why you were trying to use multivalue field evaluations?

I can see "Replicas":"1/1" in the data is what you might be interested in. If your fields are extracted, your field Replicas should have value 1/1 extracted by default. All you would need to do is

<YourBaseSearch>
 | eval Replicas=split(Replicas,"/")
 | eval ReplicasA=mvindex(Replicas,0)
 | eval ReplicasB=mvindex(Replicas,1)
 | where ReplicasA > 0

Following is a run anywhere search based on your sample data provided herewith to illustrate above code:

|  makeresults
|  eval _raw ="{\"ID\":\"de7zc794qqk1\",\"Image\":\"example.com/test:1.0.1\",\"Mode\":\"replicated\",\"Name\":\"test\",\"Ports\":\"\",\"Replicas\":\"1/1\"}"
|  spath
|  table Replicas
|  eval Replicas=split(Replicas,"/")
|  eval ReplicasA=mvindex(Replicas,0)
|  eval ReplicasB=mvindex(Replicas,1)
|  where ReplicasA > 0

---

@Rialf1959, try the following (I have tried with space as delimiter for makemv command:

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" 
| where ReplicasA > 0

Or use split() with mvindex instead of rex

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| eval WithUnit=split(WithUnit ,"/")
| eval ReplicasA=mvindex(WithUnit,0)
| eval ReplicasB=mvindex(WithUnit,1)
| where ReplicasA > 0

[Rialf1959]

It does now work with my data.

For example:
{"ID":"de7zc794qqk1","Image":"example.com/test:1.0.1","Mode":"replicated","Name":"test","Ports":"","Replicas":"1/1"}

P.S.: I have enabled json indexed extractions. So field are extracted.

[niketn]

@Rialf1959, I have updated my answer based on this sample data. However, it is confusing with this data as to why you had multi value field evaluation in your question when the information is already available in field Replicas.

[koshyk]

above works for me though. I can see the result is filtered to 3 rows which has n> 0
Which Splunk version you using?

|makeresults | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| where ReplicasA < ReplicasB

[niketn]

Just noticed, without delim also makemv command works.