Splunk Search

How to compare the columns values against another column

sangs8788
Communicator

Hi Guys,

I am having a query which would result as below,

Screenshot 2022-03-01 at 7.39.44 PM.png

The above shows count by xyz for the user selected timerange.  I would like to add one more column to this table as LessThanThreshold - which would tell the number of times the count in each day was below the corresponding Threshold value.

To be precise for a row, if the value of 01-Mar-22 < Threshold then increment the new column LessThanThreshold by 1, if 28-Feb-22<Threshold, then increment LessThanThreshold by 1. 

Using Foreach I am not sure to compare between columns itself. Could someone please help me out here.

Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval LessThanThreshold=0
| foreach *-*-*
    [| eval LessThanThreshold=if('<<FIELD>>' < Threshold, LessThanThreshold+1, LessThanThreshold)]

View solution in original post

0 Karma

venky1544
Builder

Hey @sangs8788 

just piggybacked on @ITWhisperer solution 

 | makeresults | eval xyz = 571273637828, 01-mar-22=26, 28-feb-22=13, Threshold =3, TotalCount=39
|append [|makeresults | eval xyz = 571273633123, 01-mar-22=1352, 28-feb-22=1702, Threshold =332, TotalCount=3054]
|append [|makeresults | eval xyz = 571273633267, 01-mar-22=0, 28-feb-22=40, Threshold =3, TotalCount=40]
|foreach *-*-22 [eval <<MATCHSEG1>><<MATCHSEG2>>-22_Threshold = if('<<FIELD>>' < Threshold,"LessThanThreshold_by_1","OK")]

 

venky1544_0-1646148151707.png

 

sangs8788
Communicator

Thanks for you response. This would work too. But I want more of a count rather than OK or NOT. Appreciate your effort. Thanks again

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval LessThanThreshold=0
| foreach *-*-*
    [| eval LessThanThreshold=if('<<FIELD>>' < Threshold, LessThanThreshold+1, LessThanThreshold)]
0 Karma

sangs8788
Communicator

ITWhisperer Is there a possible way to consider only the latest date column value alone and compare it with threshold field? 

0 Karma

sangs8788
Communicator

Thanks. It worked. Didnt know that I can use Threshold field inside foreach without being included in foreach condition. 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...