Hello,
I am trying to compare two fields with a simple operator but it does not seem to perform as expected. I am simply trying to return any transaction times that are over the value of the 'threshold' field. This is what I'm trying:
time_taken>threshold
I have found another way around this by using the eval command:
eval over=time_taken-threshold | search over>0
This essentially does the same thing in a very round about way but it less than neat.
Is there something i'm missing to compare field to another field? I have scoured documention but can't find any examples of this.
Thanks in advance
I think you want to use where
and not search
. The where
search operation lets you compare variables or even eval
expressions, but search
only looks for literal values. Here's an example.
This search is looking for a field named "user" that contains the value of "login":
| search user=login
This search is looking for a field named "user" that contains the same value as the field named "login":
| where user=login
So you should be able to take your example search expression:
| eval over=time_taken-threshold | search over>0
And change it to either:
| where (time_taken-threshold)>0
Or
| where time_taken>threshold
I think you want to use where
and not search
. The where
search operation lets you compare variables or even eval
expressions, but search
only looks for literal values. Here's an example.
This search is looking for a field named "user" that contains the value of "login":
| search user=login
This search is looking for a field named "user" that contains the same value as the field named "login":
| where user=login
So you should be able to take your example search expression:
| eval over=time_taken-threshold | search over>0
And change it to either:
| where (time_taken-threshold)>0
Or
| where time_taken>threshold
Splendid.
Thank you again Lowell.