topic Re: How to use a conditional variable in a stats count command? in Splunk Search

How to use a conditional variable in a stats count command?

Cuyose — Thu, 26 Jan 2017 21:39:28 GMT

Given the following search logic

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
| bin _time span=1d
| stats count as Total, count(eval(DurationTotal>$ActionSLA$) AS Latent by _time Action
| eval Percent=round(100-((Latent*100)/Total),2)

I want to have the $ActionSLA$ variable in the above pseudocode be different for each action so that I end up with results that look like the following where the Latent field is driven by the ActionSLA per Action. For instance Search ActionSLA=2000 when Action=Search, ActionSLA=4000 when Action=CreateOrder, etc.

_time              Action              Total    Latent  Percent
2017-01-26 09:00    Confirm           1259   864       31.37
2017-01-26 09:00    CreateOrder       611     147      75.94
2017-01-26 09:00    CreditRefund_Confirm 333      237      28.83
2017-01-26 09:00    FindItinerary       12461   2155      82.71
2017-01-26 09:00    Search             8349  3481     58.31

Re: How to use a conditional variable in a stats count command?

somesoni2 — Thu, 26 Jan 2017 22:07:25 GMT

Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
 | bin _time span=1d 
| eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0)
 | stats count as Total, sum(Latest) as Latent by _time Action
 | eval Percent=round(100-((Latent*100)/Total),2)

Re: How to use a conditional variable in a stats count command?

Cuyose — Thu, 26 Jan 2017 22:43:08 GMT

Ha, this is exactly what I was thinking of doing as well, but the syntax was throwing me. This did in fact work, thank you!