Splunk Search

use * in floor

Splunkie1
Loves-to-Learn Lots

I have a field called position that contains integers and a token called position_select that is either a floating point number or a * (=all positions).

Now i want to search all positions that match position_select.

So i tried something like that:

index = index1

| eval position_search = floor($position_select$)

| where position = position_search

The problem is that you of course can't use * in floor.

Another problem is that | where position = * is impossible too.

However i cant use | search because | search position = position_search  does not work.

 

So the question is, is there any way to use something like floor()  on position_select?

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set up your selection so that the value of the selection includes the where command, except in the case of *

    <input type="dropdown" token="position_select" searchWhenChanged="true">
      <label>Floored $position_select$</label>
      <choice value="">*</choice>
      <choice value="| where position=1">1.2</choice>
      <choice value="| where position=2">2.4</choice>
    </input>

Then just use the token in your search

index = index1
$position_select$
0 Karma

Splunkie1
Loves-to-Learn Lots

Thank you but, I get position_select dynamically from a search with up to 1000 results.

working through each position individually would be impractical.

Is there another way?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have your dynamic search return two fields, one with the float in as the label field, and the other with a string of the where command.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...