topic Re: multiple subsearch using appendpipe in Splunk Search

multiple subsearch using appendpipe

ljohnson_possib — Tue, 29 Sep 2020 07:33:00 GMT

I am trying to create a search that will give a table displaying counts for multiple time_taken intervals. For example I want to display the counts for calls with a time_taken of 0, time_taken between 1 and 15, time_taken between 16 and 30, time_taken between 31 and 45, time_taken between 46 and 60.......time_taken greater than 300.

Here is the search I have been playing around with to no avail:

|stats avg(time_taken) as Scenario count(eval(time_taken =0)) as Count | eval Scenario = "Calls returning in 0 time"
|appendpipe [stats count(eval(time_taken > 0 AND time_taken <= 15)) as Count | eval Scenario = "Calls returning between 1 and 15 time"]
|appendpipe [stats count(eval(time_taken > 16 AND time_taken <= 30)) as Count | eval Scenario = "Calls returning between 16 and 30 time"]
|appendpipe [stats count(eval(time_taken > 31 AND time_taken <= 45)) as Count | eval Scenario = "Calls returning between 31 and 45 time"]
|appendpipe [stats count(eval(time_taken > 46 AND time_taken <= 60)) as Count | eval Scenario = "Calls returning between 46 and 60 time"]
|appendpipe [stats count(eval(time_taken > 61 AND time_taken <= 100)) as Count | eval Scenario = "Calls returning between 61 and 100 time"]
|appendpipe [stats count(eval(time_taken > 101 AND time_taken <= 200)) as Count | eval Scenario = "Calls returning between 101 and 200 time"]
|appendpipe [stats count(eval(time_taken > 201 AND time_taken <= 300)) as Count | eval Scenario = "Calls returning between 201 and 300 time"]
|appendpipe [stats count(eval(time_taken > 300)) as Count | eval Scenario = "Calls returning more than 300"]

Re: multiple subsearch using appendpipe

woodcock — Mon, 12 Oct 2015 16:53:23 GMT

First of all, your eval Scenario= is clobbering your as Scenario so you are losing your main data element. Second, you really don't need to append anything. Give this a try:

|stats avg(time_taken) as Scenario
count(eval(time_taken =0)) as "Calls returning in 0 time" 
count(eval(time_taken > 0 AND time_taken <= 15)) as "Calls returning between 1 and 15 time"
count(eval(time_taken > 16 AND time_taken <= 30)) as "Calls returning between 16 and 30 time"
count(eval(time_taken > 31 AND time_taken <= 45)) as "Calls returning between 31 and 45 time"
count(eval(time_taken > 46 AND time_taken <= 60)) as "Calls returning between 46 and 60 time"
count(eval(time_taken > 61 AND time_taken <= 100)) as "Calls returning between 61 and 100 time"
count(eval(time_taken > 101 AND time_taken <= 200)) as "Calls returning between 101 and 200 time"
count(eval(time_taken > 201 AND time_taken <= 300)) as "Calls returning between 201 and 300 time"
count(eval(time_taken > 300)) as "Calls returning more than 300"

Re: multiple subsearch using appendpipe

ljohnson_possib — Mon, 12 Oct 2015 17:15:24 GMT

Thanks...this logic got the main data needed for the dashboard I am building. Something I haven't had since I began a week ago. The results are given all on a single row (one line of output). I am hoping to have the results in one column. This way I can use the pie chart in my dash.

Re: multiple subsearch using appendpipe

ljohnson_possib — Mon, 12 Oct 2015 17:16:31 GMT

By the way woodcock thanks a million for the answer. If I cannot get my pie chart to work, I will find a way to make the one line result work in the dashboard.

Re: multiple subsearch using appendpipe

woodcock — Tue, 13 Oct 2015 00:03:27 GMT

For a 1 column, just add this:

... | transpose

Re: multiple subsearch using appendpipe

ljohnson_possib — Tue, 13 Oct 2015 01:49:17 GMT

That worked absolutely perfect.