I know this is an older question, but I found it when looking at a similar situation. The rangemap command could not be used as the specs required that the threshold be able to be set outside of Splunk via a CSV file.
I thought of going the opposite way, looking up the threshold via it's alert level and seeing if that alert is valid.
...
| eval temp_alarm_level = "Low"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alarm_threshold >= temp_alarm_threshold , temp_alarm_level , null )
| eval temp_alarm_level = "Mid"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alert_threshold >= temp_alarm_threshold , temp_alarm_level , real_alarm_level )
| eval temp_alarm_level = "High"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alarm_threshold >= temp_alarm_threshold , temp_alarm_level , real_alarm_level )
| eval alarm_level = temp_alarm_level
| table alarm_level
Where lookup table "alarm_table" is like :
| alarm_level | alarm_threshold |
| Low | 1 |
| Mid | 2 |
| High | 3 |
my_alarm_threshold is the value you are checking to see if the alert should be raised.
The Low level alert is checked first, then Mid, and finally High. If there is no alert to be raised, the alarm_level field will be null.
Splunk will only return a result if there is an alarm to raise, which is handy when setting up alerts.
This works, but also seams a bit clunky to me, as it is doing 3 lookups.
... View more