Splunk Search

help on where condition

jip31
Motivator

hello

I use the where condition below
I would like to display the events where Free_Space <= "20" AND TotalSpace >= "164"
But I dont understand why even if the free space is < to 20 I have TotalSpace events < to 164?
You can see an example in the screenshot
thanks for your helpalt text

(index="toto" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " GB" 
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
**| where Free_Space <= "20" AND TotalSpace >= "164"**
| sort +Free_Space limit=10
Tags (1)
0 Karma
1 Solution

knielsen
Contributor

Without trying it jumps at me that you do your comparison on strings, not numbers.

You should add " %" and " GB" after you filter with your where clause, not before.

Hth,
Kai,

View solution in original post

0 Karma

knielsen
Contributor

Without trying it jumps at me that you do your comparison on strings, not numbers.

You should add " %" and " GB" after you filter with your where clause, not before.

Hth,
Kai,

0 Karma

jip31
Motivator

I m doing this but it doesnt works

| where Free_Space <= "20 %" AND TotalSpace >= "164 GB"
0 Karma

knielsen
Contributor

No, I meant:

 (index="toto" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
 | eval time = strftime(_time, "%m/%d/%Y %H:%M")
 | eval Value = round(Value, 1)
 | eval TotalSpace = TotalSpaceKB/1024
 | eval TotalSpace = round(TotalSpace/1024,1)
 | stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
 | where Free_Space <= 20 AND TotalSpace >= 164
 | eval Free_Space=FreeSpace." %", TotalSpace=TotalSpace." GB"
 | sort +Free_Space limit=10

jip31
Motivator

perfect thanks

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...