Splunk Search

How to display 2 fields as a single field in Splunk with the greater value first?

pavanae
Builder

I have a string in my search as below which combines the two fields A and B

eval big_and_small=A."and".B

Now how to give the condition to display the result to satisfy the below condition.

If A>B, display as A and B
If B>A, display as B and A

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...