How to generate a search when a field value total is less than 21?

[yograjpatel]

The Log output is below:

Need to search if Port 2003 farm total < 21

6/6/17
3:35:01.000 PM

Tue Jun 6 15:35:01 EDT 2017
Port 2003 = PLD
Port 2004 = CC
Port 2005 = Settlement
Port 2003 farm total = 21
dukerwpv01_2003 = 6
dukerwpv02_2003 = 15
dukerwpv03_2003 = 0
Port 2004 farm total = 21
dukerwpv01_2004 = 1
dukerwpv02_2004 = 6
dukerwpv03_2004 = 14
Port 2005 farm total = 40
dukerwpv01_2005 = 11
dukerwpv02_2005 = 17
dukerwpv03_2005 = 12

[yograjpatel]

Thanks woodcock and cmerriman.. both answers worked.

[woodcock]

Like this:

index=YourIndexHere sourcetype=YourSourcetypeHere Port 2003 farm total
| rex "Port 2003 farm total\s*=\s*(?<port2003farmtotal>\d+)"
| search port2003farmtotal<21

[cmerriman]

maybe something like this if you don't have that field extracted yet, otherwise if you do, you should just need the search:

rex "Port 2003 farm total = (?<port2003farmtotal>\d+)"|search port2003farmtotal<21