Splunk Search

Filter records from Table based on a column value as a number


Here is my Splunk Query:

index=test "Entry Done for Id=" | rex field=_raw Id=(?<Id>.*?)# | rex field=_raw UserID=(?<UserId>.*?)# | rex field=_raw Amount=(?<Amount>.*?)# | rex field=_raw PercentageAmount=(?<PercentageAmount>.*?)# 
| stats list(Id) as "Unique Id" list(UserID) as "User ID" list(Amount) as "Given Amount" list(PercentageAmount) as "Override Amount"
| table "Unique ID" "User ID" "Given Discount" "Override Amount"

I want to filter those records from this table which has 
Given Amount>50.00 OR Override Amount>90.00
Note:  Given Amount and Override Amount can be in decimal.

Labels (4)
0 Karma


Add the below query at the end of your search.

| search "Given Amount">50.00 OR "Override Amount">90.00


If this reply helps you, an upvote/like would be appreciated.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!