I have search below ..
|inputlookup biweekly_backup | join type=outer max=0 host [search index=tsm sourcetype="tsm-client-log" source="/server2splunk/server_sel" OR source="c:\\LogFiles\\sersel_sched.log" "Total server databases inspected" | rex field=_raw "^(?:[^:\n]*:){3}\s+(?P.+)"] | convert num(TDBs) | join type=outer max=0 host [search index=tsm sourcetype="tsm-client-log" source="/server2splunk/server_sel" OR source="c:\\LogFiles\\sersel_sched.log" "Total server databases backed up" | rex field=_raw "^(?P[^ ]+)(?:[^:\n]*:){3}\s+(?P.+)"] | convert num(DBBackedup) | join type=outer max=0 host [search index=tsm sourcetype="tsm-client-log" source="/server2splunk/server_sel" OR source="c:\\LogFiles\\sersel_sched.log" "Total server databases excluded" | rex field=_raw "^(?:[^:\n]*:){3}\s+(?P\s+\d+)"] | table host BDate TDBs DBBackedup DBexcluded
| dedup host
| eval DB_NotBackedup = (TDBs - DBBackedup)
| fillnull value=NoData
| eval Backup_Status=case(DB_NotBackedup>DBexcluded, "BackupFailed - RunEffBackup", DBBackedup="NoData", "BackupMissed - RunFullBackup", 1=1, "Success") | table Backup_Status BDate TDBs DBBackedup DBexcluded DB_NotBackedup
while comparing in |eval Backup_Status=case(DB_NotBackedup>DBexcluded,
it doesn't take field values to compare
but when i provide numeric values instead , it does,, e.g. |eval Backup_Status=case(DB_NotBackedup>4, ......
any idea what is missing?
... View more