This is the log event. 17 May 2020 16:42:28,175 [43] INFO  BWT - BWT - Nits Ratio OK 17 May 2020 16:42:30,061 [13] INFO  BWT - BWT - Mura Map - Accepted 17 May 2020 16:59:32,722 [13] INFO  BWT - BWT - Wiper Tune OK 17 May 2020 17:46:51,525 [13] INFO  BWT - BWT - Mura Map - Accepted 17 May 2020 17:46:51,623 [13] INFO  BWT - BWT - Mura Map - Accepted 17 May 2020 17:49:16,118 [35] INFO  VegaServoLogger - In StartServo() - HTTP Response ServoName is: All 17 May 2020 17:49:16,118 [35] INFO  VegaServoLogger - In StartServoService(), Starting Servo. Name: All 17 May 2020 17:49:16,118 [35] INFO  VegaServoLogger - In AddServo - Adding: PCAL 17 May 2020 17:49:16,118 [35] INFO  VegaServoLogger - In AddServo - Adding: OnPanelReTiming   If the log event is triggered, the below alert should not execute. I need a way to add a condition to handle this. ---- My Search has the below format data. A single host has multiple parameters consists of LED 1..to.20 for each TV and there are 24 TV's , The LED power paramerter has value say Max(val) 34.0 which is related to PA (power Amplitude) of Low/High, we only want search for PA = Low Query : source="c:\\program files (x86)\\xxxx" "PLogger" TV earliest=-2d@d latest=now PA = Low | stats max(VAL) by host, TV, LED, PA , _time | fields "host" "LED","PA", "TV", "max(VAL)" | Result : host LED PA TV Max (Val) _Time 03192610158 0 Low A1 48.863 2019-12-19 22:00:08.177 03192610158 0 Low A1 48.61 2019-12-20 22:00:08.140 031................. 1 Low A1 44.23 2019-12-19 22:00:08.177 031................. 1 Low A1 45.23 2019-12-20 22:00:08.177 ||||| ||||| 031................. 19 Low A1 49.23 2019-12-19 22:00:08.177 031................. 19 Low A1 50.23 2019-12-20 22:00:08.177 ||||| ||||| 031................. 1 Low A2 52.23 2019-12-19 22:00:08.177 031................. 1 Low A2 53.73 2019-12-20 22:00:08.177 AND Continues for the same host and for each TV and its LED's of 20. Now I need to calculate the percentage difference of LED 1 2..till..19 for each TV ( A1 ---A24) and raise and Alert for any LED's if they drop by 5%. This is the Splunk query I use: Now i do not want a alert to generate if i get the parameter in the logs. Need to add a condition within query and i am not able to get it to work. 17 May 2020 17:46:51,525 [13] INFO  BWT - BWT - Mura Map - Accepted 17 May 2020 17:46:51,623 [13] INFO  BWT - BWT - Mura Map - Accepted source="c:\\program files (x86)\\prysm\\servo\\logs\\vegaservo.log" "PcalLogger - LaserNits" earliest=-7d@d latest=now Tile PA = Low |stats max(VAL) AS max , min(VAL) AS min by Laser, TILE,host | eval delta_diff = max - min | fields host,Laser, TILE, max, min,delta_diff | where delta_diff > 6   ... View more

@anilchaithu  Hey thanks for reply, new to splunk here. I tried, looks like the condition is not working as expected. can you show me using the above main query on using the eval accept = if(like(_raw, "%Mura%Map%Accepted%"), "Yes","No") | stats max(VAL) AS max , min(VAL) AS min values(accept) as accept by Laser, TILE,host | where accept="No" in the main query,    ... View more

yes, want the week maximum and minimum per LED and get the percentage difference. ... View more

Just tried this , source="c:\program files (x86)\prysm\servo\logs\vegaservo.log" "PLogger ` " earliest=-7d@d latest=now TV PA = Low | eventstats max(VAL) as max_val min(VAL) as min_val by host, TILE, Laser, PA , _time 16 May 2020 05:01:32,798 [13] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 49.138 16 May 2020 05:01:33,825 [30] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 40.388 16 May 2020 07:31:29,563 [13] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 42.771 16 May 2020 05:01:26,504 [18] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 40.617 16 May 2020 06:01:17,954 [28] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 56.235 16 May 2020 05:02:48,667 [13] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 49.563 16 May 2020 05:01:55,969 [13] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 49.563 15 May 2020 05:02:13,664 [11] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 56.425 15 May 2020 05:02:01,916 [8] INFO PcalLogger - LaserNits: TV= C3, LED = 17, PA = Low, VAL = 54.894 15 May 2020 05:01:42,815 [15] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 58.274 15 May 2020 05:01:33,853 [21] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 56.425 15 May 2020 05:01:47,114 [4] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 49.393 15 May 2020 05:01:39,954 [11] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 47.566 15 May 2020 05:01:32,599 [17] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 36.822 15 May 2020 05:01:37,341 [20] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 49.028 15 May 2020 05:01:31,575 [13] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 49.627 15 May 2020 10:11:12,863 [10] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 36.742 15 May 2020 05:01:33,639 [21] INFO PcalLogger - LaserNits: TV = C3, LED= 17, PA = Low, VAL = 40.457 15 May 2020 07:31:30,474 [12] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 42.566 15 May 2020 05:01:26,318 [13] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 40.594 15 May 2020 06:01:18,128 [29] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 56.145 15 May 2020 05:01:43,558 [18] INFO PcalLogger - LaserNits: TV= C3, LED = 17, PA = Low, VAL = 53.515 14 May 2020 05:02:22,486 [26] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 48.056 14 May 2020 05:01:43,976 [4] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 58.351 14 May 2020 05:01:41,404 [26] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 48.056 14 May 2020 05:01:33,721 [11] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 57.254 14 May 2020 05:01:48,204 [23] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 49.906 14 May 2020 05:01:38,857 [15] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 47.89 14 May 2020 05:01:28,036 [19] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 36.776 14 May 2020 05:01:38,073 [19] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 49.041 14 May 2020 05:01:26,628 [11] INFO PcalLogger - LaserNits: TV = C3, LED = 17, PA = Low, VAL = 49.871 I tried |stats values(max_val) as max_val, values(min_val) as min_val -- The Max and Min value for each LED for the week as a stats not able to get it. What am i doing wrong here. ... View more

I tried it , It is taking only max and min of last 1 day and computing it. What is needed is Max and Min value reported for the week for each LED. and perform the perc_diff calculation. ... View more

@to4kawa Any suggestion to correct the query. I am stuck on this. ... View more

Hi, I am relooking at this answer as we decide to go live. What i see is that for the max and Min value is not correctly applied. -- Each TV has 20 LED , So Max and Min value for the duration of -7d@d is not giving correct value. The calculation takes the latest day value as min and not sorting for max and min to give the correct delta. What could be the change in query to reflect the correct output. ... View more

Thank you, Works perfectly. ... View more

Thank you, the query works partially wherin for the next set of LED the values are not listed. ... View more

Great it works, Thank you. How can i now show it to display the result with specific LED (1--20) on each TV (1...24) deployed at multiple hosts . Basically i need an alert messge with Host - Led no - Tv no. so its easy to identify if any location has a issue with LED dropping by 5% and for the TV number . ... View more