How do you compare if a stats count is greater than another field?

[veerendra_modi]

I have a stats result with the count field. I want to compare if this count is greater than another field. I.e., a threshold field in my stats result dynamically.

I want to compare count with threshold and then tag the event as False or True.

[woodcock]

Try adding this to the end of your existing search:

| eval comparison=if(count>threshold, "True", "False")

If you literally mean to tag it, then do this:

| eval tag=mvappend(tag, if(count>threshold, "True", "False"))

[renjith_nair]

@veerendra_modi ,

In general, you could use eval status=if(count>threshold,"False","True") .

However , it looks like you have multi value fields from your stats and guess you are using list(field). If you have only one value per row based on your by clause, you may use stats first(field) as field . But it's purely based on your current search and would be helpful if you could share it.

If you still need multivalue fields, you may extract the first element for threshold and count as eval threshold=mvindex(threshold,0) , count =mvindex(count ,0) and compare them as mentioned above.

[skoelpin]

Give us a sample of your SPL