Splunk Search

Find nearest value in numeric multivalue field to other numeric field

New Member

I have events with a numeric field "Amount" and a field "User". In a KV Store collection I keep the Amount history values for a each User (AmountHist). With a lookup I can get the AmountHist for a user in a numeric multivalue field.

Given a new event for a user and the the value of Amount, I need to get the nearest value from the AmountHist (where AmountHist is a multivalue field and Amount a single value field).

I cant use mvexpand to do it because Amount_Hist is very large and mvexpand produce exesive memory usage when is applied for multiple events.

Thanks a lot for any sugerence.

0 Karma