Splunk Search

Convert string to number and compare

Rialf1959
Explorer

Hello,
why this is not working ?

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" | where ReplicasA > 0 

I even tryied this:

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| eval n=tonumber(ReplicasA) | where n > 0

Thanks

0 Karma

niketn
Legend

[Updated Answer based on Sample JSON Data]

@Rialf1959, is this a single event or can an event have multiple such nodes? I am trying to understand as to why you were trying to use multivalue field evaluations?

I can see "Replicas":"1/1" in the data is what you might be interested in. If your fields are extracted, your field Replicas should have value 1/1 extracted by default. All you would need to do is

<YourBaseSearch>
 | eval Replicas=split(Replicas,"/")
 | eval ReplicasA=mvindex(Replicas,0)
 | eval ReplicasB=mvindex(Replicas,1)
 | where ReplicasA > 0

Following is a run anywhere search based on your sample data provided herewith to illustrate above code:

|  makeresults
|  eval _raw ="{\"ID\":\"de7zc794qqk1\",\"Image\":\"example.com/test:1.0.1\",\"Mode\":\"replicated\",\"Name\":\"test\",\"Ports\":\"\",\"Replicas\":\"1/1\"}"
|  spath
|  table Replicas
|  eval Replicas=split(Replicas,"/")
|  eval ReplicasA=mvindex(Replicas,0)
|  eval ReplicasB=mvindex(Replicas,1)
|  where ReplicasA > 0

@Rialf1959, try the following (I have tried with space as delimiter for makemv command:

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" 
| where ReplicasA > 0

Or use split() with mvindex instead of rex

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| eval WithUnit=split(WithUnit ,"/")
| eval ReplicasA=mvindex(WithUnit,0)
| eval ReplicasB=mvindex(WithUnit,1)
| where ReplicasA > 0
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Rialf1959
Explorer

It does now work with my data.

For example:
{"ID":"de7zc794qqk1","Image":"example.com/test:1.0.1","Mode":"replicated","Name":"test","Ports":"","Replicas":"1/1"}

P.S.: I have enabled json indexed extractions. So field are extracted.

0 Karma

niketn
Legend

@Rialf1959, I have updated my answer based on this sample data. However, it is confusing with this data as to why you had multi value field evaluation in your question when the information is already available in field Replicas.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

koshyk
Super Champion

above works for me though. I can see the result is filtered to 3 rows which has n> 0
Which Splunk version you using?

|makeresults | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| where ReplicasA < ReplicasB

niketn
Legend

Just noticed, without delim also makemv command works.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...