Rewriting value of field if value is negative

Question

Hi,

I would like to rewrite bogus field values that are negative to 0. For example I would like to run the following search and plot a timechart of all 3 values, but change any that are negative to 0.

timechart max(mms_run_time_hour) as "MMS Run Time" max(vfn_run_time_hour) as "VFN Run Time" max(sms_run_time_hour)

Thanks

Accepted Answer

3	You can use an eval search command like this: `... \| eval bogus_field=if(bogus_field>0, bogus_field, 0)` Or, perhaps even better: `... \| eval bogus_field=max(bogus_field,0)` link answered 17 Jul '10, 02:44 Lowell ♦ 11.1k●9●12●89 accept rate: 41%

Rewriting value of field if value is negative

Follow this question

Splunk Resources

Related questions