I have 2 fields called sc_bytes & cs_bytes in my results. How can I then filter my results to give me events when the value for cs_bytes is greater than the value for sc_bytes? Much thanks.
How about this
your base search cs_bytes>sc_bytes
e.g. index=foo sourcetype=bar cs_bytes>sc_bytes
You need the where
command. This is one of the big differences between using search vs
where` for subsequently filtering results.
Just add this to your search:
| where cs_bytes > sc_bytes
In search
the right hand side of any operator (ie =, >, <) is always assumed to be a literal value (whether or not it's in quotes) but in where
unquoted strings on the right hand side are interpreted as the values of that named field.
The other huge difference of course, is that in where
you can use any eval functions (ie any of the long list of functions you would more typically see in the eval
command.)
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
So to take a simple example, you could filter to only the rows where cs_bytes
is greater than BOTH sc_bytes
and some_other_bytes
| where cs_bytes > max(sc_bytes,some_other_bytes)