Splunk Search

compared to a threshold whose value varies depending on the value of another field

myli12
Path Finder

I am processing packets drop log events and want to have a report that contains only those events with nopktDrop>= threshold. I have the following from raw log data, with each row extracted from an event log message

time policy noPktDrop
time1 1 45
time2 2 50
time3 3 30
time4 2 36

The threshold for each policy is different, for example, threshold = 40, 30, and 40 for policy 1, 2, and 3, respectively in the above example. What I want to have is the following report:

time policy noPktDrop
time1 1 45
time2 2 50
time4 2 36

Any suggestion on how to generate such a report?

0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

There are a number of options. If there are a large number of policy ids, or you will reuse the policy/threshold mappings in numerous searches, you might consider using a lookup to maintain the policy/threshold mappings. Otherwise, here is a simple way:

... | eval t = case(policy == 1, 45, policy == 2, 40, policy == 3, 40) | where noPktDrop >= t

View solution in original post

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

There are a number of options. If there are a large number of policy ids, or you will reuse the policy/threshold mappings in numerous searches, you might consider using a lookup to maintain the policy/threshold mappings. Otherwise, here is a simple way:

... | eval t = case(policy == 1, 45, policy == 2, 40, policy == 3, 40) | where noPktDrop >= t
0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...