topic Re: How to categorize search results as "good" or "bad" based on values returned? in Splunk Search

How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 14:34:03 GMT

1) In the picture attached, I want to display the values >300 as good and less than 300 as bad

2) The other part is to calculate the avg of each row (i.e. (calgary+leatherhead+Melbourne)/3) and display a new column with the avg of those, and if the value is >350 it is good and less than 350 as bad

Re: How to categorize search results as "good" or "bad" based on values returned?

lguinn2 — Wed, 09 Sep 2015 17:54:29 GMT

There is no picture attached. Perhaps you could cut-and-paste the search query. Highlight the text of the search query, then use the 101010 icon to format it as "code" and it will look fine.

Re: How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 17:56:03 GMT

can you see the pic now

Re: How to categorize search results as "good" or "bad" based on values returned?

somesoni2 — Wed, 09 Sep 2015 18:05:33 GMT

What you want to show as in good OR bad? Can you provide sample output you expect?

Re: How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 18:16:14 GMT

if the avg of three fields calgary+leatherhead+Melbourne/3 is greater than 300 then the avg value should be displayed and it should fall in good category for example
_time calgary houston
2015-09-08 10 20

melbourne average status
30 20 good

the average of 10+20+30/3=20
since its avg is greater than 10 it is good or else it should be bad

Re: How to categorize search results as "good" or "bad" based on values returned?

somesoni2 — Wed, 09 Sep 2015 18:25:29 GMT

One final question, will it be ok for your to fix the span of timechart??

Re: How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 18:27:51 GMT

ya so is there anything to do with that

Re: How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 18:31:39 GMT

Hi somesh if you dont mind can i have your email id..i have seen you have almost 3 yrs exp in splunk as a dev and admin

Re: How to categorize search results as "good" or "bad" based on values returned?

somesoni2 — Wed, 09 Sep 2015 18:39:30 GMT

Try something like this (fixed the timechart span to 30 mins in bucket/timechart command)

index=pams ..rest of base search host="ups... rest of host filter | eval duration=(2048/duration)*1000 | bucket span=30m _time | stats avg(duration) as duration by _time hostname | eval sitecode=substr(upper(hostname),1,3) | lookup app_utc_site_lat_long.csv sitecode OUTPUTNEW site | table _time site duration | appendpipe [| stats avg(duration) as duration by _time | eval site="TotalAvg"] | timechart span=30m avg(duration) as duration by site | eval category=if(TotalAvg>300,"Good","Bad")

Re: How to categorize search results as "good" or "bad" based on values returned?

somesoni2 — Wed, 09 Sep 2015 18:39:58 GMT

Sure.. it's somesh.soni@gmail.com

Re: How to categorize search results as "good" or "bad" based on values returned?

woodcock — Wed, 09 Sep 2015 18:49:22 GMT

Like this:

index=pams sourcetype=transaction transaction_status=Success transaction="PAMS 2GiB Read" (host=ups6z4420yh24* OR host=ldn6z442166w6* OR host=cal6z442804vy* OR host=esh6z4419fvaj*) earliest=-1d@d latest=now | eval duration=2048000/duration | eval sitecode=substr(upper(hostname),1,3) | loookup app_utc_site_lat_long.csv sitecode OUTPUTNEW site | timechart avg(duration) by site | addtotals row=t | eval cols=-2 | foreach * [eval cols=cols+1] | eval AllSiteAvg=Total/cols | fields - Total cols | foreach * [eval <<FIELD>>_status = if((<<FIELD>> > 300), "GOOD", "BAD")] | fields - _time_status

Re: How to categorize search results as "good" or "bad" based on values returned?

vrmandadi — Wed, 09 Sep 2015 19:42:40 GMT

thank you so much guys

Re: How to categorize search results as "good" or "bad" based on values returned?

woodcock — Thu, 10 Sep 2015 13:28:29 GMT

Be sure to close out the question by pickimg the answer that you like the best and clicking "Accept".