Splunk Search

How do you compare if a stats count is greater than another field?

veerendra_modi
Loves-to-Learn

I have a stats result with the count field. I want to compare if this count is greater than another field. I.e., a threshold field in my stats result dynamically.

I want to compare count with threshold and then tag the event as False or True.

0 Karma

woodcock
Esteemed Legend

Try adding this to the end of your existing search:

| eval comparison=if(count>threshold, "True", "False")

If you literally mean to tag it, then do this:

| eval tag=mvappend(tag, if(count>threshold, "True", "False"))
0 Karma

renjith_nair
Legend

@veerendra_modi ,

In general, you could use eval status=if(count>threshold,"False","True") .

However , it looks like you have multi value fields from your stats and guess you are using list(field). If you have only one value per row based on your by clause, you may use stats first(field) as field . But it's purely based on your current search and would be helpful if you could share it.

If you still need multivalue fields, you may extract the first element for threshold and count as eval threshold=mvindex(threshold,0) , count =mvindex(count ,0) and compare them as mentioned above.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Give us a sample of your SPL

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...