Solved: Re: How to use where command to keep only specific... - Splunk Community

Splunk Search

My query so far looks like this:

sourcetype="type1" OR sourcetype="type2" |chart count(sales1) over sales2 by sourcetype

How would I pipe in | where ..

so that it only keeps rows where the value in type1 is greater than twice the value in type2?

1 Solution

Solution

Just add:

| where type1 > (2 * type2)

View solution in original post

Solution

Just add:

| where type1 > (2 * type2)

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...