I am having one field and it has 2 values. Comparing them with each other I want to generate a message whether "Success" or "Failure".
Below are details:
// Search
| table _time, ErrorCount | sort 2 _time
It gives me result like
_time ErrorCount
2-Jan-20 16:35:00 10
2-Jan-20 16:34:00 14
I want to show "Success" if ErrorCount at latestTime < ErrorCount at earliestTime and failure if its otherwise.
Here is one way to do it:
| makeresults
| eval data="2-Jan-20 16:35:00,10;
2-Jan-20 16:34:00,14"
| makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim=","
| eval _time=strptime(mvindex(data,0),"%d-%b-%y %H:%M:%S"),
ErrorCount=mvindex(data,1)
| fields _time ErrorCount
| autoregress ErrorCount p=1
| eval status=case(ErrorCount<ErrorCount_p1,"Success",ErrorCount>=ErrorCount_p1,"Failure",1==1,null())
| fields - ErrorCount_p1
This uses autoregress to allow comparison with earlier rows.
Here is one way to do it:
| makeresults
| eval data="2-Jan-20 16:35:00,10;
2-Jan-20 16:34:00,14"
| makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim=","
| eval _time=strptime(mvindex(data,0),"%d-%b-%y %H:%M:%S"),
ErrorCount=mvindex(data,1)
| fields _time ErrorCount
| autoregress ErrorCount p=1
| eval status=case(ErrorCount<ErrorCount_p1,"Success",ErrorCount>=ErrorCount_p1,"Failure",1==1,null())
| fields - ErrorCount_p1
This uses autoregress to allow comparison with earlier rows.
Thanks:) worked swiftly