Splunk Search

How to display 2 fields as a single field in Splunk with the greater value first?

pavanae
Builder

I have a string in my search as below which combines the two fields A and B

eval big_and_small=A."and".B

Now how to give the condition to display the result to satisfy the below condition.

If A>B, display as A and B
If B>A, display as B and A

0 Karma
1 Solution

MuS
Legend

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi pavanae,

you can try something like this:

eval big_and_small = if(A > B, A. "and" .B, B. "and " .A)

This should give you something to start, although I know it will not handle cases where the numbers are equal 😉

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...