topic How to only display columns where the duration is > 1 second? in Splunk Search

How to only display columns where the duration is > 1 second?

djoobbani — Thu, 08 Dec 2022 04:10:32 GMT

Dear Splunk Community :

I have the following search query:

<Basic_search> duration | stats count, avg(duration), perc99(duration), by path_template

Attached please find a sample of the screen result for the above search.

ITWhisperer — Wed, 07 Dec 2022 21:41:40 GMT

duration isn't one of your columns

djoobbani — Wed, 07 Dec 2022 21:45:29 GMT

Sorry forgot to ask the question.

I need to modify this search :

source=r42-core-api msg="served request" duration | stats count, avg(duration) by path_template

to only display the columns/numbers where avg(duration) > 1 second.

How do i do that?

Thanks!

bowesmana — Wed, 07 Dec 2022 21:46:25 GMT

Maybe you're looking for

| eval "avg(duration)"=if('avg(duration)'<1,null(),'avg(duration)') | eval "perc99(duration)"=if('perc99(duration)'<1,null(),'perc99(duration)')

which will clear any values that are less than zero in the two duration columns.

Note you would be better off renaming your columns in the stats, as it makes it easier to manipulate the fields afterwards, e.g.

| stats count, avg(duration) as AvgDuration, perc99(duration) asP99Duration, by path_template

djoobbani — Wed, 07 Dec 2022 22:01:28 GMT

Great, that works! Thanks for the info. appreciate it!