How to extract a threshold from lookup and create a default value?

[JohnnyMnemonic]

Hi, 

I'm trying to create a filter based on a threshold value that is unique for some objects and fixed for the others.

index=main
| loopup thresholds_table.csv object output threshold
| where number > threshold

The lookup contains something like:

object	threshold
chair	20
pencil	40

The problem here is that no all objects are inside the lookup, so I want to fix a threshold number for all other objects, for example I want to fix a threshold of 10 for every object except for those inside the lookup.

I tried these things without success:

index=main | loopup thresholds_table.csv object output threshold | eval threshold = coalesce(threshold, 10) | where number > threshold

index=main | fillnull value=10 threshold | loopup thresholds_table.csv object output threshold | where number > threshold

index=main | eval threshold = 10 | loopup thresholds_table.csv object output threshold | where number > threshold

The objective is identify when an object reach an X average value, except for those objects that have a higher average value.

[gcusello · Accepted solution]

Hi @JohnnyMnemonic,

if the threshold value is fixed when not present in the lppkup, you can use an eval:

index=main
| loopup thresholds_table.csv object output threshold
| eval threshold=if(isnull(threshold),10,threshold)
| where number > threshold

Ciao.

Giuseppe

[JohnnyMnemonic]

EDIT: Nevermind, I had an issue in my splunk server that was returning incorrect results, the solution works perfect!

Thanks!