Splunk Search

Logic for looped if greater than statement

MeMilo09
Path Finder

Hey There, 

Below I have a field in where ABC > 2500 cuz the value is actually 2800. So then If ABC>than 2500 add 1 day to the Human_readable field. I have already created the logic to adding 1 day to the Human_readable field.... Question now is how can I write the logic for it in a nested loop? So If ABC>2500 add 1 day to human readable. 

This is my logic that I have thus far:

| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")

This is what I have so far:

| makeresults

| eval ABC="2800", DEF="3", GHI="5"
| eval rel_Time="11102021"

| eval Epoch_Time=strpTime(rel_Time,"%m%d%Y")
| eval Human_readable=strfTime(Epoch_Time, "%B %d, %Y")

| eval Service=if(ABC>2500, "Send Alert", "No Alert")
| eval Add_1Day=strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")
| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y") 

| table Service Epoch_Time Human_readable Add_1Day Then_Set



Labels (1)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Maybe you can clarify what is expected from this "nested loop" and how is results from the logic you created so far different from the expectation?

By the way, the last if() statement in your illustration is incomplete in syntax.  It should be something like

| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")

For example,

 

| makeresults

| eval ABC="2800", DEF="3", GHI="5"
| eval rel_Time="11102021"

| eval Epoch_Time=strpTime(rel_Time,"%m%d%Y")
| eval Human_readable=strfTime(Epoch_Time, "%B %d, %Y")

| eval Service=if(ABC>2500, "Send Alert", "No Alert")
| eval Add_1Day=strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")
| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")

| table Service Epoch_Time Human_readable Add_1Day Then_Set

 

gets you

ServiceEpoch_TimeHuman_readableAdd_1dayThen_Set
Send Alert1636531200.000000November 10, 2021November 11, 2021November 11, 2021

View solution in original post

MeMilo09
Path Finder

Thanks, basically it was my syntax that was throwing me off... since I had:

| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")

I was not sure of the syntax therefore I was not seeing expected results - and you demonstrated the correct syntax:

| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Maybe you can clarify what is expected from this "nested loop" and how is results from the logic you created so far different from the expectation?

By the way, the last if() statement in your illustration is incomplete in syntax.  It should be something like

| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")

For example,

 

| makeresults

| eval ABC="2800", DEF="3", GHI="5"
| eval rel_Time="11102021"

| eval Epoch_Time=strpTime(rel_Time,"%m%d%Y")
| eval Human_readable=strfTime(Epoch_Time, "%B %d, %Y")

| eval Service=if(ABC>2500, "Send Alert", "No Alert")
| eval Add_1Day=strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")
| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")

| table Service Epoch_Time Human_readable Add_1Day Then_Set

 

gets you

ServiceEpoch_TimeHuman_readableAdd_1dayThen_Set
Send Alert1636531200.000000November 10, 2021November 11, 2021November 11, 2021
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...