Splunk Search

How to display 2 fields as a single field in Splunk with the greater value first?

pavanae
Builder

I have a string in my search as below which combines the two fields A and B

eval big_and_small=A."and".B

Now how to give the condition to display the result to satisfy the below condition.

If A>B, display as A and B
If B>A, display as B and A

0 Karma
1 Solution

MuS
Legend

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...