Splunk Search

How can I find values within a specific range/ make sure each value meets the criteria of a particular range?

agoktas
Communicator

Hello,

We have the following search:
index="blah"
| stats values(Change), values(Volume), values(Price) by Symbol

Some results are too large or too small of a number range, so I want to fine tune the range.

How do I do this?

| stats values (Change){range=0.001:0.100}
???

How do I make sure each value meets the criteria of a particular range?

Thanks!

0 Karma

troyward
Explorer

Not entirely sure I understand what you're trying to ask. The values command is just going to list the value that is already attached to that record. Are you wanting to not include a record that falls outside of that range? If that is the case, I would include that as part of your original search before it feeds into your stats function.

Your option is if you just want to change a value that falls outside of that range to something that does is again, before the stats function do an eval...

| eval Change = if(change < 0.001, 0.001, if (change > 0.1, 0.1, change))

0 Karma

agoktas
Communicator

Hi troyward,

Thanks for your reply. Yes, that is correct.

| eval Change = if(change < 0.001, 0.001, if (change > 0.1, 0.1, change))
works perfect for the "Change" field.

I need it to apply to 3 total fields. If one doesn't match, then result should not show.

How do I do an eval on 3 different fields?

Perhaps...
| eval Change = if(change < 0.001, 0.001, if (change > 0.1, 0.1, change)), Volume = if(Volume < 0.002, 0.002, if (Volume > 1.0, 1.0, Volume)), Price = if(Price < 1.0, 1.0, if (Price > 0.001, 0.001, Price))

Or can you not simply comma separate the different fields for eval?

Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...