Splunk Search

Rewriting value of field if value is negative

Path Finder

Hi,

I would like to rewrite bogus field values that are negative to 0. For example I would like to run the following search and plot a timechart of all 3 values, but change any that are negative to 0.

timechart max(mms_run_time_hour) as "MMS Run Time" max(vfn_run_time_hour) as "VFN Run Time" max(sms_run_time_hour)

Thanks

Tags (2)
0 Karma
1 Solution

Super Champion

You can use an eval search command like this:

... | eval bogus_field=if(bogus_field>0, bogus_field, 0)

Or, perhaps even better:

... | eval bogus_field=max(bogus_field,0)

View solution in original post

Super Champion

You can use an eval search command like this:

... | eval bogus_field=if(bogus_field>0, bogus_field, 0)

Or, perhaps even better:

... | eval bogus_field=max(bogus_field,0)

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!