Splunk Search

Custom Condition

TiagoMatos
Path Finder

Hello, I have a table that returns with these fields: AvgLow and AvgLowNOW, but they appear many times, like this

AvgLow AvgLowNOW
a b
a b
a b
a b
a b

I need to create an alert for when AvgLowNOW is greater then AvgLow. But in custome search condition with "search AvgLowNOW>AvgLow", I catch no events. What can I do to solve this?

Thank you

Tags (2)
0 Karma
1 Solution

wagnerbianchi
Splunk Employee
Splunk Employee

Try if() or case() eval functions
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Eval

  • hypothetical example:
  • index=appmgmt | eval x=if(status>=status_description,1,0) | table x

View solution in original post

0 Karma

rturk
Builder

Hi Tiago,

From your comments in the other answer, it looks as though you're nearly there. The where function is definitely your friend.

<base search> | where AvgLow < AvgLowNOW

This will return all results where AvgLowNOW is greater than AvgLow (no need to dedup)

Reference:

wagnerbianchi
Splunk Employee
Splunk Employee

Try if() or case() eval functions
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Eval

  • hypothetical example:
  • index=appmgmt | eval x=if(status>=status_description,1,0) | table x
0 Karma

TiagoMatos
Path Finder

Ok thank you!

0 Karma

wagnerbianchi
Splunk Employee
Splunk Employee

Is that work? look the example I've just sent...

0 Karma

TiagoMatos
Path Finder

I tried this

search dedup AvgOut,AvgOutQNOW | where AvgOutQNOW>AvgOut

0 Karma

TiagoMatos
Path Finder

I'm Portuguese, but on my work place I don't have access to skype.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...