Splunk Search

Custom Condition

TiagoMatos
Path Finder

Hello, I have a table that returns with these fields: AvgLow and AvgLowNOW, but they appear many times, like this

AvgLow AvgLowNOW
a b
a b
a b
a b
a b

I need to create an alert for when AvgLowNOW is greater then AvgLow. But in custome search condition with "search AvgLowNOW>AvgLow", I catch no events. What can I do to solve this?

Thank you

Tags (2)
0 Karma
1 Solution

wagnerbianchi
Splunk Employee
Splunk Employee

Try if() or case() eval functions
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Eval

  • hypothetical example:
  • index=appmgmt | eval x=if(status>=status_description,1,0) | table x

View solution in original post

0 Karma

rturk
Builder

Hi Tiago,

From your comments in the other answer, it looks as though you're nearly there. The where function is definitely your friend.

<base search> | where AvgLow < AvgLowNOW

This will return all results where AvgLowNOW is greater than AvgLow (no need to dedup)

Reference:

wagnerbianchi
Splunk Employee
Splunk Employee

Try if() or case() eval functions
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Eval

  • hypothetical example:
  • index=appmgmt | eval x=if(status>=status_description,1,0) | table x
0 Karma

TiagoMatos
Path Finder

Ok thank you!

0 Karma

wagnerbianchi
Splunk Employee
Splunk Employee

Is that work? look the example I've just sent...

0 Karma

TiagoMatos
Path Finder

I tried this

search dedup AvgOut,AvgOutQNOW | where AvgOutQNOW>AvgOut

0 Karma

TiagoMatos
Path Finder

I'm Portuguese, but on my work place I don't have access to skype.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...