Splunk Search

Why doesn't a > WHERE clause work when an = does?

47024
New Member

I cannot seem to get my search to return results when comparing a property with a greater than comparison even though using an equals comparison does work. The 'elements' property in my message is a 0 - x property of the event...meaning it could exist zero times or it could exist multiple times...each element in the event has a 'y' value.

What i'm trying to accomplish is to count each time an event occurs where any of the elements in the event have a y value greater than a value.

example:

This search returns 2 :
index="lab" source="*-test" | eval y='line.message.space-document.design.elements{}.y' | where y="1664" | stats count

This search returns 0 when it should be the same if not more than the above search:
index="lab" source="*-test" | eval y='line.message.space-document.design.elements{}.y' | where y>"1663" | stats count

Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If y is multivalue, then things get complicated. If you do a

| table y

do you get a single value field for y in all cases, or multivalue?

If you want to filter where any mv value > 1663, then you need to use mvfilter, e.g.

| makeresults 
| eval y=mvappend("100","200","300","400","2000","500")
| eval x=mvfilter(y>1663)
| where mvcount(x)>0

in this case, it will satisfy the condition, but this will not

| makeresults 
| eval y=mvappend("100","200","300","400","1000","500")
| eval x=mvfilter(y>1663)
| where mvcount(x)>0

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If y is multivalue, then things get complicated. If you do a

| table y

do you get a single value field for y in all cases, or multivalue?

If you want to filter where any mv value > 1663, then you need to use mvfilter, e.g.

| makeresults 
| eval y=mvappend("100","200","300","400","2000","500")
| eval x=mvfilter(y>1663)
| where mvcount(x)>0

in this case, it will satisfy the condition, but this will not

| makeresults 
| eval y=mvappend("100","200","300","400","1000","500")
| eval x=mvfilter(y>1663)
| where mvcount(x)>0
0 Karma

47024
New Member

This worked! Thank you very much!

0 Karma

to4kawa
Ultra Champion
index="lab" source="*-test" 
| eval y='line.message.space-document.design.elements{}.y' 

It seems that there are multiple y values.

index="lab" source="*-test" 
| eval y='line.message.space-document.design.elements{}.y' 
| eval y=mvindex(y,0)
| stats count(eval(y > 1663)) as count
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't support greater-than / less-than with strings. If y is a number then use ... | where y>1663 | .... If y is a string use tonumber() to convert it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

47024
New Member

Thank you for the suggestion...however when taking the string aspect away, it actually returns 0 results with both equals and greater comparisons. I changed to below and still get 0 results when I should get at least 2.

index="lab" source="*-test" | eval y=tonumber('line.message.space-document.design.elements{}.y') | where y>1663 | stats count

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share some sample data? Have you tried the second part of my answer (tonumber())?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...