For all row, how can i make splunk query following 'for loop'?
for(i=1, i<100, i=i+1)
{
factor1_prev=factor1_min+factor1_hierarchy_flag*(i-1)
factor1_pv=factor1_min+factor1_hierarchy_flag*i
factor1_next=factor1_min+factor1_hierarchy_flag*(i+1)
case(factor1_prev<factor1_pv<factor1_next)
factor1_hierarchy=i
case(factor1_pv>factor1_max)
return 0
}
Hi leejaeyong,
you can try this:
| makeresults count=100
| streamstats count AS foo
| eval factor1_min=(random() % 100) /2, factor1_hierarchy_flag=(random() % 100) +2
| rename comment AS "This ^^^ just creates dummy data"
| eval factor1_prev=factor1_min+factor1_hierarchy_flag*(foo-1),
factor1_pv=factor1_min+factor1_hierarchy_flag*foo,
factor1_next=factor1_min+factor1_hierarchy_flag*(foo+1),
factor1_hierarchy=case(factor1_prev < factor1_pv AND factor1_pv <factor1_next, foo, factor1_pv>factor1_max, 0, true(), "unknonw")
Everything up until the rename
command creates just dummy events, and the last eval
will be your loop over the 100 events. In this example foo
is your i
in your code.
Hope this helps ...
cheers, MuS
PS: I noticed that in your example factor1_max
is missing that's why the last case()
statement never will match.
'MuS' thank you
but i think that did not communicate my problem in sufficient quantity.
My final purpose is factor1 grouping.
I want somebody see before / after search result and code.
*befor search result
factor1 | factor1_hierarchy_flag | factor1_hierarchy_level | factor1_min | factor1_max
num1 | NumA | 100 | NumB | NumC
num2 | NumA | 100 | NumB | NumC
num3 | NumA | 100 | NumB | NumC
num4 | NumA | 100 | NumB | NumC
num5 | NumA | 100 | NumB | NumC
num6 | NumA | 100 | NumB | NumC
num7 | NumA | 100 | NumB | NumC
num8 | NumA | 100 | NumB | NumC
num9 | NumA | 100 | NumB | NumC
num10 | NumA | 100 | NumB | NumC
… | … | … | … | …
*wanted query
factor1_hierarchy_level = 100
factor1_refference_value = 'one of all factor1 number'
for(i=1, i<=factor1_hierarchy_level, i=i+1)
{
factor1_prev=factor1_min+factor1_hierarchy_flag*(i-1)
factor1_next=factor1_min+factor1_hierarchy_flag*(i)
case(factor1_prev<factor1_refference_value<factor1_next)
factor1_grouping=i
case(factor1_pv>factor1_max)
return 0
}
*after search result(grouping colunm creating)
factor1 | factor1_hierarchy_flag | factor1_hierarchy_level | factor1_min | factor1_max | factor1_grouping
num1 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num2 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num3 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num4 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num5 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num6 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num7 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num8 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num9 | NumA | 100 | NumB | NumC | one of number from 1 to 100
num10 | NumA | 100 | NumB | NumC | one of number from 1 to 100
… | … | … | … | … | …