Splunk Search

How to display 2 fields as a single field in Splunk with the greater value first?

pavanae
Builder

I have a string in my search as below which combines the two fields A and B

eval big_and_small=A."and".B

Now how to give the condition to display the result to satisfy the below condition.

If A>B, display as A and B
If B>A, display as B and A

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...