Splunk Search

How do you compare if a stats count is greater than another field?

veerendra_modi
Loves-to-Learn

I have a stats result with the count field. I want to compare if this count is greater than another field. I.e., a threshold field in my stats result dynamically.

I want to compare count with threshold and then tag the event as False or True.

0 Karma

woodcock
Esteemed Legend

Try adding this to the end of your existing search:

| eval comparison=if(count>threshold, "True", "False")

If you literally mean to tag it, then do this:

| eval tag=mvappend(tag, if(count>threshold, "True", "False"))
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@veerendra_modi ,

In general, you could use eval status=if(count>threshold,"False","True") .

However , it looks like you have multi value fields from your stats and guess you are using list(field). If you have only one value per row based on your by clause, you may use stats first(field) as field . But it's purely based on your current search and would be helpful if you could share it.

If you still need multivalue fields, you may extract the first element for threshold and count as eval threshold=mvindex(threshold,0) , count =mvindex(count ,0) and compare them as mentioned above.

Happy Splunking!
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Give us a sample of your SPL

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...