Splunk Search

How to compare and save the values between some columns

New Member

Hi all,
I have below input:

alt text

Now I want to do below comparision:

(Row1 = started AND row2=started ) OR (row3="started" AND Row4="started")

The result is good otherwise result is bad.

I don't know how to do that comparison and save the value, can anyone please help?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@ruchijain,

You have almost the solution in your question itself. Probably you haven't specified the fields correctly

| eval result=if(('row 1' = "started" AND 'row 2'="started" ) OR ('row 3'="started" AND 'row 4'="started"),"good","bad")

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@ruchijain,

You have almost the solution in your question itself. Probably you haven't specified the fields correctly

| eval result=if(('row 1' = "started" AND 'row 2'="started" ) OR ('row 3'="started" AND 'row 4'="started"),"good","bad")

View solution in original post

0 Karma

New Member

Hi Renjith,

Please find the image attahced:

But if i will look for bad it will alert for the first row but i think i got the option like if number of result if greater than 1 then it will alert.

Can i use this query?

eventtype=cxpeditorialmob | chart latest(status) as status by raxhost | transpose | eval result=if(('row 1'!= "started" AND 'row 2'!="started" ) OR ('row 3'="started" AND 'row 4'="started"),"good","bad")

alt text

0 Karma

SplunkTrust
SplunkTrust
    eventtype=cxp_editorial_mob | chart latest(status) as status by raxhost | transpose | eval result=if(('row 1'!= "started" AND 'row 2'!="started" ) OR ('row 3'="started" AND 'row 4'="started"),"good","bad")
    |where result=="bad"

and then trigger alert if Number of Results is greater than 0.

0 Karma

New Member

Thanks renjith for the answer.

Just need one more i got below output:

alt text

I want to juts check for the row status if it is good or bad...

Means i want to get alert if the status row is bad... how to do that

0 Karma

SplunkTrust
SplunkTrust

@ruchijain,
the image is not available. You could add |where result=="bad" to your search and trigger alert if Number of Results is greater than 0

0 Karma