https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264157#M189823 <P>Hi vinay4444, I believe something like this will work, referencing the documentation on case : <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and_Conditional_functions">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and_Conditional_functions</A></P> <PRE><CODE>index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="x",10,itemKey=="y",1)."m" | return $spantime ] $statistic$(value) by name </CODE></PRE> <P>Guessing you are spanning in minutes, so concatenated an m to the end, but you could modify that or build it into the case statement.</P> <P>Let me know how this works!</P> Mon, 12 Oct 2015 14:27:38 GMT muebel 2015-10-12T14:27:38Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264155#M189821 <P>index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name</P> <P>how can i add logic for $spantime$ to take values based on itemkey value <BR /> case itemKey = "x" then 10<BR /> case itemKey = "y" then 1 ?</P> Mon, 12 Oct 2015 13:28:28 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264155#M189821 vinay4444 2015-10-12T13:28:28Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264156#M189822 <P>I'm not sure the timechart command will work with variable substitution, but if it does it will be something like this.</P> <PRE><CODE>index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | eval spantime=case(itemKey="x",10, itemKey="y",1, 1=1,1) | timechart span=$spantime$m $statistic$(value) by name </CODE></PRE> Mon, 12 Oct 2015 14:27:34 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264156#M189822 richgalloway 2015-10-12T14:27:34Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264157#M189823 <P>Hi vinay4444, I believe something like this will work, referencing the documentation on case : <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and_Conditional_functions">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and_Conditional_functions</A></P> <PRE><CODE>index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="x",10,itemKey=="y",1)."m" | return $spantime ] $statistic$(value) by name </CODE></PRE> <P>Guessing you are spanning in minutes, so concatenated an m to the end, but you could modify that or build it into the case statement.</P> <P>Let me know how this works!</P> Mon, 12 Oct 2015 14:27:38 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264157#M189823 muebel 2015-10-12T14:27:38Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264158#M189824 <P>thanks for the response i tried both methods but could not see change in span value <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="ms.db.cpu_usage_percent*",1,itemKey=="ms.db.connection_count",10)."m" | return $spantime ] SUM(value) by name</P> Tue, 29 Sep 2020 07:33:03 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264158#M189824 vinay4444 2020-09-29T07:33:03Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264159#M189825 <P>whats the literal search look like in the job inspector?</P> Mon, 12 Oct 2015 15:27:50 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264159#M189825 muebel 2015-10-12T15:27:50Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264160#M189826 <P>index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name</P> Mon, 12 Oct 2015 15:29:28 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264160#M189826 vinay4444 2015-10-12T15:29:28Z https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264161#M189827 <P>based on value selected by user in itemKey we need to set the spantime for time chart</P> Mon, 12 Oct 2015 15:32:13 GMT https://community.splunk.com/t5/Splunk-Search/case-statement-using-token-for-span-in-timechart/m-p/264161#M189827 vinay4444 2015-10-12T15:32:13Z