Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

validate a value base on the lookup

$
0
0
I have a csv lookup table like: item, expression a, "value>12 AND value<14" b, "value=1" c, "value!=111 " d, "value<10 OR value>100" .... And I have the log like: 2016-09-09 13:13:13, item=a, value=13 2016-09-09 13:13:14, item=b, value=131 2016-09-09 13:13:15, item=c, value=3 2016-09-09 13:13:16, item=d, value=1 I can lookup ouput a new field called expression base on the lookup table. And I want to validate if the value in each record matches the corresponding expression. Is it possible to do that? Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>