topic Re: IF/CASE for multiple variables in Dashboards & Visualizations

IF/CASE for multiple variables

klaudiac — Wed, 18 Nov 2020 14:34:28 GMT

Hi guys,

Looking for a bit of help because I confused myself at this point and can't think logically 😞

I'm creating a search where I can show uploads vs downloads, and the criteria is as follow:

*if bytes_in (download) is more than 70% of all the bytes for that user, then the main action is data download and I want to add a column "alert" with a value "download"

*if bytes_out (upload) is more than 70% of all the bytes for that user, then the main action is data upload and I want to add to the column "alert" that it's going to be an "upload"

*if the bytes in and our are within 20% of the even split, then the value in the "alert" column will be no action.
if the split is even, then "no action".

Now, how do I do it in Splunk??

Re: IF/CASE for multiple variables

inventsekar — Wed, 18 Nov 2020 15:12:05 GMT

index=indexName | eval user_bytes_perc_download = (bytes_in/all_bytes_user)*100 | eval user_bytes_perc_upload = (bytes_out/all_bytes_user)*100 | eval alert=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <20 AND user_bytes_perc_upload < 20, "no action")

if the bytes in and our are within 20% of the even split - I got confused with this, so the query is as per my understanding.

Re: IF/CASE for multiple variables

klaudiac — Wed, 18 Nov 2020 15:26:15 GMT

Thanks so much, almost there 🙂
I should have specified better - the equal split would be 50-50% between in and out. So anything that's within the 30% (not 20 - sorry, I'm losing it today) margin would be "no action" e.g. 60% are uploads and 40% are downloads = "no action"

Re: IF/CASE for multiple variables

klaudiac — Wed, 18 Nov 2020 15:34:29 GMT

Nevermind - I have it 🙂

Thanks so much for your help!