Splunk Search

How do i compare the field values in my search?

New Member

I have a field here like total_time which has 100+ values (0.125,2.25,etc).

I want the result like the field total_time values which are greater than 10.

my search is search_command | eval responsetime=if(total_time>20, "Yes", "No")

BUT the above search is taken as a count and showing the results.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Are you trying to filter to keep only the events/records for which the total_time value is greater than 10?? If yes, the try like this

search_command | where total_time>10

If not then probably more details here would help, like expected output.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Are you trying to filter to keep only the events/records for which the total_time value is greater than 10?? If yes, the try like this

search_command | where total_time>10

If not then probably more details here would help, like expected output.

View solution in original post

0 Karma

New Member

Thanks.

It works for me.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!