Splunk Search

Evaluate the results of Chart over By

Engager

Below Query Provides the Result.
counter="% Processor Time" | chart avg(Value) over host by counter | search "% Processor Time")>10

But Below Search Query doesnt work
counter="% Processor Time" | chart avg(Value) over host by counter | eval SLA_Status=if("% Processor Time">10,"Yes","No")

Any way to tackle this

Tags (4)
1 Solution

SplunkTrust
SplunkTrust

Try this

counter="% Processor Time" | chart avg(Value) over host by counter | eval SLA_Status=if('% Processor Time'>10,"Yes","No")

View solution in original post

SplunkTrust
SplunkTrust

Try this

counter="% Processor Time" | chart avg(Value) over host by counter | eval SLA_Status=if('% Processor Time'>10,"Yes","No")

View solution in original post