Splunk Search

Lexicographic comparison of version strings?

waisbrot
Engager

I have version strings in my log output, and I'd like to filter on these, like

| where version < 2.3.5

But Splunk only wants to do numeric comparison with '<'. Is there an operator to perform lexicographic comparisons?

Tags (2)
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

I am not aware of a function or command to do this.

However, you could use a more complicated where clause if we assume you have broken out the version into fields major, minor and point....

|where major > 2 OR (major >=2 AND minor >3) OR (major >=2 AND minor >= 2 AND point > 5)

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

I am not aware of a function or command to do this.

However, you could use a more complicated where clause if we assume you have broken out the version into fields major, minor and point....

|where major > 2 OR (major >=2 AND minor >3) OR (major >=2 AND minor >= 2 AND point > 5)
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...