Hi,
I'm trying to create a filter based on a threshold value that is unique for some objects and fixed for the others.
index=main | loopup thresholds_table.csv object output threshold | where number > threshold |
The lookup contains something like:
object | threshold |
chair | 20 |
pencil | 40 |
The problem here is that no all objects are inside the lookup, so I want to fix a threshold number for all other objects, for example I want to fix a threshold of 10 for every object except for those inside the lookup.
I tried these things without success:
index=main | loopup thresholds_table.csv object output threshold | eval threshold = coalesce(threshold, 10) | where number > threshold |
index=main | fillnull value=10 threshold | loopup thresholds_table.csv object output threshold | where number > threshold |
index=main |
The objective is identify when an object reach an X average value, except for those objects that have a higher average value.
Hi @JohnnyMnemonic,
if the threshold value is fixed when not present in the lppkup, you can use an eval:
index=main
| loopup thresholds_table.csv object output threshold
| eval threshold=if(isnull(threshold),10,threshold)
| where number > threshold
Ciao.
Giuseppe
Hi @JohnnyMnemonic,
if the threshold value is fixed when not present in the lppkup, you can use an eval:
index=main
| loopup thresholds_table.csv object output threshold
| eval threshold=if(isnull(threshold),10,threshold)
| where number > threshold
Ciao.
Giuseppe
EDIT: Nevermind, I had an issue in my splunk server that was returning incorrect results, the solution works perfect!
Thanks!