Splunk Search

How do you compare if a stats count is greater than another field?

veerendra_modi
Loves-to-Learn

I have a stats result with the count field. I want to compare if this count is greater than another field. I.e., a threshold field in my stats result dynamically.

I want to compare count with threshold and then tag the event as False or True.

0 Karma

woodcock
Esteemed Legend

Try adding this to the end of your existing search:

| eval comparison=if(count>threshold, "True", "False")

If you literally mean to tag it, then do this:

| eval tag=mvappend(tag, if(count>threshold, "True", "False"))
0 Karma

renjith_nair
Legend

@veerendra_modi ,

In general, you could use eval status=if(count>threshold,"False","True") .

However , it looks like you have multi value fields from your stats and guess you are using list(field). If you have only one value per row based on your by clause, you may use stats first(field) as field . But it's purely based on your current search and would be helpful if you could share it.

If you still need multivalue fields, you may extract the first element for threshold and count as eval threshold=mvindex(threshold,0) , count =mvindex(count ,0) and compare them as mentioned above.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Give us a sample of your SPL

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...