topic Re: sum values if< in Splunk Search

sum values if<

HeinzWaescher — Mon, 28 Sep 2020 15:12:13 GMT

Hi,

I'm calculating a duration for each event in the dataset and would like to calculate the sum for all durations < 43200000

stats sum(eval(if(Duration_ms<43200000, Duration_ms,0))) AS total_duration

I made some tests and it the results seem to fit approximately, but I don't feel conifdent whether this is the correct approach. Am I doing it right? Do i need some quotes somewhere in the if-command?

Is it also possible to have " > AND < " condition here? So to sum all durations >0 AND <43200000.

Thanks

Heinz

Re: sum values if<

kristian_kolb — Tue, 05 Nov 2013 11:32:49 GMT

that works fine

stats sum(eval(if((Duration_ms > 0 AND Duration_ms<43200000), Duration_ms,0))) AS Total_Duration

or to make it more readable, if it fits your use case, you can make the conditions part of the search terms;

sourcetype = blah Duration_ms > 0 Duration_ms < 43200000 | stats sum(Duration_ms) as Total_Duration

Re: sum values if<

HeinzWaescher — Tue, 05 Nov 2013 11:49:59 GMT

Hi Kristian,

the second option doesn't fit, because i need these filtered events for other stats in this search.

Thanks a lot for confirming and adding the AND function!