Splunk Search

Eval Equals Another Field

cquinney
Communicator

Greetings,

I have a query that ends with a timechart command

| timechart span=1h eval(round(avg(FIELD),0)) as "Response" by source_type

Previously, I created thresholds for my timechart by using eval

| eval Normal = 500
| eval High = 1000

However, as my number of source_types grew, I could no longer utilize the same thresholds. I've created a lookup that contains the necessary thresholds for each specific source_type, and I can see the new field created in the fields column on the left hand side of the screen. However, I'm having trouble adding this new field or setting this new field as its intended threshold delimiter.

So how can create a timechart (which I have to keep/utilize) and incorporate my thresholds from my lookup?

The final output would look similar to this:

_time              Source_Type     Normal          High
3/3/19             ABC               500             1000

Any help is greatly appreciated.

0 Karma

woodcock
Esteemed Legend

Like this:

... | timechart span=1h eval(round(avg(FIELD),0)) AS Response BY Source_Type
| untable _time sourcetype count
| lookup MyThresholdLookup Source_Type
...
0 Karma

cquinney
Communicator

Thank you for suggestion but it didn't give the outcome I need. Do you know of a way to to create a new field based on another field or from the lookup?

| eval Normal=Lookup.csv Normal

0 Karma

woodcock
Esteemed Legend

Let's start over. Show me:
1: A few raw events
2: Your full search (all of it)
3: Your current output
4: The first 2 lines of your Lookup.csv file
5: A mockup of your desired output

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...