Splunk Search

How do i write a query on SPL to have a flag when next value of an event is greater then the precedence value?

royimad
Builder

How do i write a query on SPL to have a flag when next value on events is greater then the precedence value?

Hereby an example and the expected Result , values are from 1 to 100 and results should be zero or one when next value is greater then precedence value

>     event 1: value 1  [ Result:0]
>     event 2: value 2  [ Result:1]
>     event 3: value 2  [ Result:0]
>     event 4: value 2  [ Result:0]
>     event 5: value 3  [ Result:1]
>     event 6: value 3  [ Result:0]
>     event 7: value 1  [ Result:0]
>     event 8: value 1  [ Result:0]
>     event 9: value 2  [ Result:1]
>     event 10:value 2  [ Result:0]
0 Karma
1 Solution

Matthias_BY
Communicator

Hi,

  • | delta

then you can make a eval with if statement. eval result= if(delta=0, 0, 1)

if the delta value is 0 assign 0 every other value assign 1

br
matthias

View solution in original post

Matthias_BY
Communicator

Hi,

  • | delta

then you can make a eval with if statement. eval result= if(delta=0, 0, 1)

if the delta value is 0 assign 0 every other value assign 1

br
matthias

Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...