Splunk Search

Lexicographic comparison of version strings?

waisbrot
Engager

I have version strings in my log output, and I'd like to filter on these, like

| where version < 2.3.5

But Splunk only wants to do numeric comparison with '<'. Is there an operator to perform lexicographic comparisons?

Tags (2)
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

I am not aware of a function or command to do this.

However, you could use a more complicated where clause if we assume you have broken out the version into fields major, minor and point....

|where major > 2 OR (major >=2 AND minor >3) OR (major >=2 AND minor >= 2 AND point > 5)

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

I am not aware of a function or command to do this.

However, you could use a more complicated where clause if we assume you have broken out the version into fields major, minor and point....

|where major > 2 OR (major >=2 AND minor >3) OR (major >=2 AND minor >= 2 AND point > 5)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...