Splunk Search
Highlighted

Evaluate the results of Chart over By

Engager

Below Query Provides the Result.
counter="% Processor Time" | chart avg(Value) over host by counter | search "% Processor Time")>10

But Below Search Query doesnt work
counter="% Processor Time" | chart avg(Value) over host by counter | eval SLA_Status=if("% Processor Time">10,"Yes","No")

Any way to tackle this

Tags (4)
Highlighted

Re: Evaluate the results of Chart over By

SplunkTrust
SplunkTrust

Try this

counter="% Processor Time" | chart avg(Value) over host by counter | eval SLA_Status=if('% Processor Time'>10,"Yes","No")

View solution in original post