How to display 2 fields as a single field in Splunk with the greater value first?

[pavanae]

I have a string in my search as below which combines the two fields A and B

eval big_and_small=A."and".B

Now how to give the condition to display the result to satisfy the below condition.

If A>B, display as A and B
If B>A, display as B and A

[MuS · Accepted solution]

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS