Hi Splunk'az,
I have events composed of 64 key/value pairs that are being extracted into fields at indexing time:
"d" : {
"field01" : [ 0 ],
"field02" : [ 5 ],
"field03" : [ 2 ],
"field04" : [ 3 ],
[...]
"field64" : [ 38]
}
I would like to chart the "value" of the field "only if" it is above a certain threshold.
I was initially thinking using 'where':
| stats count last(field*) | where field* > 100
But the above doesn't work as 'where' can't contain a wildcard...
Then I was looking at the 'foreach' function. And trying something like:
| foreach c5x* [eval new_<>=if(<> > 0, <>, null)]
| table new_*
But the above doesn't work either, and still, I would have to get rid of the 'null' values from fields using a wildcard again. So the problem would remain the same.
So, how can I chart a set of fields values only if the value is above a certain threshold? And without having to hardcode to complete list of fields obviously 😉
Thanks in advance!
... View more
