topic Re: How to filter search result based on case condition in Getting Data In

How to filter search result based on case condition

andreigro — Tue, 29 Sep 2020 13:56:53 GMT

Hi guys, I'm new to splunk and I have one issue with filtering my search results based on a case condition
My search string:
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

I now I need to filter this based on the field named host=selected_host

It doesn't sound very complex but I cannot make it work.
Thank you,
Andrei

Re: How to filter search result based on case condition

richgalloway — Thu, 04 May 2017 12:18:39 GMT

Try one of these.

sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | where host=selected_host | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

sourcetype="WMI:CPUTime" | where host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

Re: How to filter search result based on case condition

andreigro — Thu, 04 May 2017 12:21:15 GMT

Thanks a lot! Tried the first query and it worked!

Re: How to filter search result based on case condition

niketn — Thu, 04 May 2017 12:38:09 GMT

May I know how you are setting $ddl_instance$ token?

It is most likely that eval can be used to set token at the same place for host directly. That way you will be able to add host in your base query hence resulting in filtering required results upfront rather than later. This should improve your search performance. (http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting)

In the current query you can change by host to by selected_host in your timechart command

sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by selected_host limit=20