hello
I use this code
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: | eval Value=round(Value, 2)."%" | where Value > "40.00%" | dedup host | table host Value
but the WHEN condition dont works because when I do I have also datas
what I have to do for having 1 if Value > 40% and 0 if Value <40% when i count the events?
thanks
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: Value>40
| dedup host
| eval Value=round(Value, 2)."%"
| table host Value
If you only want the events where the Value is greater than 40 you can add that to your initial search and it will drop any other events.
"(?<percent>.*)%"
will extract the numerical value...
You can test it with -
index=<any index>
| eval _raw="40.00%"
| rex field=_raw "(?<percent>.*)%"
thanks!
regards
And this might be useful -
index=<any index>
| eval _raw="40.00%"
| rex field=_raw "(?<percent>.*)%"
| eval percent2 = case(percent >= 40, 1, percent < 40, 0)
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: Value>40
| dedup host
| eval Value=round(Value, 2)."%"
| table host Value
If you only want the events where the Value is greater than 40 you can add that to your initial search and it will drop any other events.
perfect thanks!