Splunk Search

help on where condition

jip31
Motivator

hello

I use the where condition below
I would like to display the events where Free_Space <= "20" AND TotalSpace >= "164"
But I dont understand why even if the free space is < to 20 I have TotalSpace events < to 164?
You can see an example in the screenshot
thanks for your helpalt text

(index="toto" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " GB" 
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
**| where Free_Space <= "20" AND TotalSpace >= "164"**
| sort +Free_Space limit=10
Tags (1)
0 Karma
1 Solution

knielsen
Contributor

Without trying it jumps at me that you do your comparison on strings, not numbers.

You should add " %" and " GB" after you filter with your where clause, not before.

Hth,
Kai,

View solution in original post

0 Karma

knielsen
Contributor

Without trying it jumps at me that you do your comparison on strings, not numbers.

You should add " %" and " GB" after you filter with your where clause, not before.

Hth,
Kai,

0 Karma

jip31
Motivator

I m doing this but it doesnt works

| where Free_Space <= "20 %" AND TotalSpace >= "164 GB"
0 Karma

knielsen
Contributor

No, I meant:

 (index="toto" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
 | eval time = strftime(_time, "%m/%d/%Y %H:%M")
 | eval Value = round(Value, 1)
 | eval TotalSpace = TotalSpaceKB/1024
 | eval TotalSpace = round(TotalSpace/1024,1)
 | stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
 | where Free_Space <= 20 AND TotalSpace >= 164
 | eval Free_Space=FreeSpace." %", TotalSpace=TotalSpace." GB"
 | sort +Free_Space limit=10

jip31
Motivator

perfect thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...