Splunk Search

How to write this query when variable names instead of constants need to be used to automate the query

iTechEvent
Explorer

Here is a simplified version of my issue.

I have csv file as below named Q.csv

  1. Q1avg, Q2avg
  2. 100 ,
  3. , 90
  4. , 100
  5. , 110

Need to check how many times Q2avg values exceeded Q1avg value.
The constraint, I cant use hard coded values in the where, eval statements.
For eg. | inputcsv Q.csv | where Q2avg > 100

instead of 100 i need to use something like first(Q1Avg) i.e. instead of hard coded constant need to use a variable name for constant.

| inputcsv Q.csv | where Q2avg > first(Q1avg) but it wont work

Also

| inputcsv Q.csv | stats count(eval(Q2avg > 100 )) -- cant use this hard coded value of 100.

Instead need to use something like

| inputcsv Q.csv | stats count(eval(Q2avg > Q1avg ) ) -- not 100 but use field/variable name for it but it wont work

The reason is I need to automate this and not use manual input.

Any help will be appreciated.

0 Karma
1 Solution

linu1988
Champion

Hello,
You can use map command.
1st:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1)|map[| inputcsv Q.csv | where Q2avg > $AvgQ1$]

2nd:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1|map [| inputcsv Q.csv | stats count(eval(Q2avg > $AvgQ1$ ))]

Thanks

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

| inputcsv Q.csv | eventstats first(Q1avg) as myQ1 | where myQ1 < Q2avg
0 Karma

linu1988
Champion

Hello,
You can use map command.
1st:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1)|map[| inputcsv Q.csv | where Q2avg > $AvgQ1$]

2nd:

| inputcsv Q.csv | stats first(Q1avg) as AvgQ1|map [| inputcsv Q.csv | stats count(eval(Q2avg > $AvgQ1$ ))]

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...