Splunk Search

Where and eval weirdness?

Lowell
Super Champion

I have a multi-value field called TotalRows (which is in contains a list of values in time order) and I'm trying to determine when the last value is less than the first value as a simple means to detect decreasing trend in the field....

This approach works:

... | eval first_rows=mvindex(TotalRows,0) 
    | eval last_rows=mvindex(TotalRows,-1)
    | where first_rows>last_rows

But when I simply this expression and remove the extra (unwanted) fields, it doesn't work:

... | where mvindex(TotalRows,0) > mvindex(TotalRows,-1) 

Any ideas?

Tags (3)
0 Karma
1 Solution

Lowell
Super Champion

Hmm, think I figured it out.

It looks like mvindex must always consider it's return value to be a string. Therefore, forcing it to a number allows the single expression to work:

... | where tonumber(mvindex(TotalRows,0)) > tonumber(mvindex(TotalRows,-1)) 

View solution in original post

Lowell
Super Champion

Hmm, think I figured it out.

It looks like mvindex must always consider it's return value to be a string. Therefore, forcing it to a number allows the single expression to work:

... | where tonumber(mvindex(TotalRows,0)) > tonumber(mvindex(TotalRows,-1)) 

ryhluc01
Communicator

Hey @Lowell can you select your answer?

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...