Splunk Search

max of two column

vb1612
New Member

Hi , my search output is like

mysearch | table col1 col2 col3

I want col4 as max(col1,col2)

Thanks

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@vb1612 ,

should be possible with a simple eval unless there are some hidden complexities.

|eval col4=if(col1>col2,col1,col2)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@vb1612 ,

should be possible with a simple eval unless there are some hidden complexities.

|eval col4=if(col1>col2,col1,col2)
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...