Splunk Search

Rewriting value of field if value is negative

mcwomble
Path Finder

Hi,

I would like to rewrite bogus field values that are negative to 0. For example I would like to run the following search and plot a timechart of all 3 values, but change any that are negative to 0.

timechart max(mms_run_time_hour) as "MMS Run Time" max(vfn_run_time_hour) as "VFN Run Time" max(sms_run_time_hour)

Thanks

Tags (2)
0 Karma
1 Solution

Lowell
Super Champion

You can use an eval search command like this:

... | eval bogus_field=if(bogus_field>0, bogus_field, 0)

Or, perhaps even better:

... | eval bogus_field=max(bogus_field,0)

View solution in original post

Lowell
Super Champion

You can use an eval search command like this:

... | eval bogus_field=if(bogus_field>0, bogus_field, 0)

Or, perhaps even better:

... | eval bogus_field=max(bogus_field,0)
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...