Splunk Search
Highlighted

How to create a condition statement

Explorer

Is there a possibility in Splunk to get data like below :

If a condition is true then that data is to be printed in table 

If (a $lt; b)

eval c=round(((b-a)/b)*100),0)

print c (in table format)

Or else just a message on full screen that with "no change".

0 Karma
Highlighted

Re: How to create a condition statement

Influencer

@dkdeepshikhaa if there are multiple events in your query your conditional evaluation will be based on each event. You can get no change text in table with below query-

<your search>| eval var=round(((b-a)/b)*100),0) | eval c = if(a<b,var,"no change") | table c
Highlighted

Re: How to create a condition statement

Champion
0 Karma