Numeric Comparison on Eventtype?

[Jason]

I'm dealing with a stream of monitoring data with good and bad events, but no text to distinguish them apart. Good vs. bad is defined as follows, by comparing the same two fields found in every event:

Good event: previous_status < current_status
Bad event: current_status < previous_status

I need to be able to eventtype and tag these events, but comparing two fields in the search command does not seem possible - I only got expected results by using a | where and that is not supported in an eventtype.

How do I eventtype this data properly?

And why can we only compare a field to a static numeric value in search, rather than another numeric field??

[araitz]

'search' assumes that the right side of the comparison is a string literal (i.e how x=y is processed on the right-most part of the search). 'where' treats both sides as variables rather than literals, similar to sql's 'where'.

Event types are designed to classify specific types of events, not comparisons of two or more events. You should probably look at alerting.

[Jason]

I updated the question above with better clarity. Both fields are in the same event. I just need to compare the two fields to one another, and it seems a bit unreasonable that you have to use a separate command for this.

[gkanapathy · Accepted solution]

No, you can't do this in a base search (or equivalently, in the search command), and therefore you can't specify this as an eventtype. I think this is a fairly straightforward and reasonable enhancement request.

[gkanapathy]

What he isn't making clear (which he did offline) is that the two fields he is comparing are two field in the same event. If they were in different events, I would agree with you, but for numeric comparisons of fields in the same events (not string comparisons, and not in different events) this is not really any different from what Splunk already does. Furthermore, for eventtyping, it would be okay even if the fields are non-numeric.

[araitz]

I disagree - this is far outside the design of eventtyping and tagging.