Splunk Search

How to write this query when variable names instead of constants need to be used to automate the query

iTechEvent
Explorer

Here is a simplified version of my issue.

I have csv file as below named Q.csv

  1. Q1avg, Q2avg
  2. 100 ,
  3. , 90
  4. , 100
  5. , 110

Need to check how many times Q2avg values exceeded Q1avg value.
The constraint, I cant use hard coded values in the where, eval statements.
For eg. | inputcsv Q.csv | where Q2avg > 100

instead of 100 i need to use something like first(Q1Avg) i.e. instead of hard coded constant need to use a variable name for constant.

| inputcsv Q.csv | where Q2avg > first(Q1avg) but it wont work

Also

| inputcsv Q.csv | stats count(eval(Q2avg > 100 )) -- cant use this hard coded value of 100.

Instead need to use something like

| inputcsv Q.csv | stats count(eval(Q2avg > Q1avg ) ) -- not 100 but use field/variable name for it but it wont work

The reason is I need to automate this and not use manual input.

Any help will be appreciated.

0 Karma
1 Solution

linu1988
Champion

Hello,
You can use map command.
1st:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1)|map[| inputcsv Q.csv | where Q2avg > $AvgQ1$]

2nd:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1|map [| inputcsv Q.csv | stats count(eval(Q2avg > $AvgQ1$ ))]

Thanks

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| inputcsv Q.csv | eventstats first(Q1avg) as myQ1 | where myQ1 < Q2avg
0 Karma

linu1988
Champion

Hello,
You can use map command.
1st:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1)|map[| inputcsv Q.csv | where Q2avg > $AvgQ1$]

2nd:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1|map [| inputcsv Q.csv | stats count(eval(Q2avg > $AvgQ1$ ))]

Thanks

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!