How to get the events where the value is greater than 40 using where condition?

[jip31]

hello

I use this code

index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  | eval Value=round(Value, 2)."%" | where Value > "40.00%"  | dedup host | table host Value

but the WHEN condition dont works because when I do I have also datas
what I have to do for having 1 if Value > 40% and 0 if Value <40% when i count the events?
thanks

[ddrillic]

"(?<percent>.*)%" will extract the numerical value...

You can test it with -

index=<any index>
| eval _raw="40.00%"
| rex field=_raw "(?<percent>.*)%"

[jip31]

thanks!
regards

[ddrillic]

And this might be useful -

index=<any index>
| eval _raw="40.00%"
| rex field=_raw "(?<percent>.*)%"
| eval percent2  = case(percent >= 40, 1, percent < 40, 0)

[kmaron · Accepted solution]

index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: Value>40 
| dedup host 
| eval Value=round(Value, 2)."%" 
| table host Value

If you only want the events where the Value is greater than 40 you can add that to your initial search and it will drop any other events.

[jip31]

perfect thanks!