Splunk Search

Filtering in search string.

SplunkBaby
Explorer

I have a working search string like

host=ABC | rename  "H Code" TO HCODE | join HCODE [search host= EFG  ] | timechart span=1d sum(Visits) AS Visit, count(USERCOUNT) AS UserCount  by HCODE | foreach Visit* [ eval Avg:<<MATCHSTR>> = '<<FIELD>>'/'UserCount<<MATCHSTR>>'] | fields Avg:*

I want to avoid Avg value less than 0.I tried where it is not working.
can anybody help.

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi,

here is a run everywhere example how to do this:

index=_internal source=*metrics.log | eventstats avg(kbps) as avg_kbps by series | eval avg:*=avg_kbps | table avg:* | search avg:*>1.5

this will return an table of all values of avg:* higher then 1.5

cheers, MuS

0 Karma

SplunkBaby
Explorer

The query which you have give is working.I think the reason behind is avg:* is fixed field name.In my case field name is dynamic. Avg:<>

0 Karma

MuS
SplunkTrust
SplunkTrust

update ping

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...