topic String validation in chart eval in Splunk Search

String validation in chart eval

marellasunil — Tue, 09 Apr 2013 19:49:39 GMT

For another query where I have to use not equal to in a query for string, even not equal to is not working properly in eval There are 10 services with Success and failures, Consider as A, B ...J, for one service say B there is an error code 102, 103 & 104 (It is an error). If errorcode is 102 I want to add it to success so I used the query

.. | chart count(eval(Status="Success" OR ServiceName="B" AND ErrorCode=102)) as "Success", count(eval(Status="Error" OR ServiceNameLookup="B" AND ErrorCode!=102)) as "Fail" by ServiceName

This query counting 102 for both sucess & falures.

Any suggetions for both please

Re: String validation in chart eval

kristian_kolb — Wed, 10 Apr 2013 07:12:44 GMT

UPDATE (or rather a complete rewrite)

It's too late in this TZ to do any clever thinking. Forget the previous attempt, and do like this instead;

... | eval NewStat = if(errorcode=="102" AND service=="B", "success", status) | ...

This creates a temporary variable called NewStat in each event, which will be set to 'success' if the errorcode=102 and the service=B, for all other events it will just copy the value of 'status'.

Then you can use NewStat for any further reporting, such as;

... | chart c over service by NewStat

Hope this helps,

Kristian

Re: String validation in chart eval

marellasunil — Wed, 10 Apr 2013 19:43:24 GMT

Sorry, Kristian. That did't work. 😞 tried in several ways

Re: String validation in chart eval

kristian_kolb — Mon, 15 Apr 2013 22:21:54 GMT

see update above. tested and working. /k