Comparison
eq
Compares the left and right arguments and returns true if they are equal and false if they are not. It returns null if the arguments are not comparable.
- Function Input
- Left: T
- Right: T
- Function Output
- boolean
DSL example
Returns events where timestamp is equal to 0.
eq(get("timestamp"), "0");
gt
Compares the left and right arguments and returns true if the left is greater than the right and false if it is less. It returns null the arguments are not comparable.
- Function Input
- Left: T
- Right: T
- Function Output
- boolean
DSL example
Returns events where the field "count" is greater than 10.
gt(get("count"), "10");
gte
Compares the left and right arguments and returns true if the left is greater than or equal to the right and false if it is not. It returns null if the arguments are not comparable.
- Function Input
- Left: T
- Right: T
- Function Output
- boolean
DSL example
Returns events where the field "nanos" is greater than or equal to 5.
gte(get("nanos"), "5");
lt
Compares the left and right arguments and returns true if the left is less than the right and false if it is greater. It returns null if the arguments are not comparable.
- Function Input
- Left: T
- Right: T
- Function Output
- boolean
DSL example
Returns events where the field "count" is less than 10000.
lt(get("count"), 10000);
lte
Compares the left and right arguments and returns true of the left is less than or equal to the right and false if it is not. It returns null if the arguments are not comparable.
- Function Input
- Left: T
- Right: T
- Function Output
- boolean
DSL example
Returns events where the timestamp is less than epoch-time 1554240547.
lte(get("timestamp", 1554240547);
Boolean | Conditional |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.0
Feedback submitted, thanks!