Splunk Search

How to compare the columns values against another column

sangs8788
Communicator

Hi Guys,

I am having a query which would result as below,

Screenshot 2022-03-01 at 7.39.44 PM.png

The above shows count by xyz for the user selected timerange.  I would like to add one more column to this table as LessThanThreshold - which would tell the number of times the count in each day was below the corresponding Threshold value.

To be precise for a row, if the value of 01-Mar-22 < Threshold then increment the new column LessThanThreshold by 1, if 28-Feb-22<Threshold, then increment LessThanThreshold by 1. 

Using Foreach I am not sure to compare between columns itself. Could someone please help me out here.

Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval LessThanThreshold=0
| foreach *-*-*
    [| eval LessThanThreshold=if('<<FIELD>>' < Threshold, LessThanThreshold+1, LessThanThreshold)]

View solution in original post

0 Karma

venky1544
Builder

Hey @sangs8788 

just piggybacked on @ITWhisperer solution 

 | makeresults | eval xyz = 571273637828, 01-mar-22=26, 28-feb-22=13, Threshold =3, TotalCount=39
|append [|makeresults | eval xyz = 571273633123, 01-mar-22=1352, 28-feb-22=1702, Threshold =332, TotalCount=3054]
|append [|makeresults | eval xyz = 571273633267, 01-mar-22=0, 28-feb-22=40, Threshold =3, TotalCount=40]
|foreach *-*-22 [eval <<MATCHSEG1>><<MATCHSEG2>>-22_Threshold = if('<<FIELD>>' < Threshold,"LessThanThreshold_by_1","OK")]

 

venky1544_0-1646148151707.png

 

sangs8788
Communicator

Thanks for you response. This would work too. But I want more of a count rather than OK or NOT. Appreciate your effort. Thanks again

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval LessThanThreshold=0
| foreach *-*-*
    [| eval LessThanThreshold=if('<<FIELD>>' < Threshold, LessThanThreshold+1, LessThanThreshold)]
0 Karma

sangs8788
Communicator

ITWhisperer Is there a possible way to consider only the latest date column value alone and compare it with threshold field? 

0 Karma

sangs8788
Communicator

Thanks. It worked. Didnt know that I can use Threshold field inside foreach without being included in foreach condition. 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...