topic Re: Greater Than & Less Than or Equal To in Splunk Search

Greater Than & Less Than or Equal To

IRHM73 — Thu, 04 Feb 2016 12:11:23 GMT

Hi, I wonder whether someone may be able to help me please.

I've created the line below which is part of a bigger query.

|eval groupduration=case(duration<=300,"<5 minutes", >300 AND <=600, "Between 5 & 10 Minutes")

The problem I have is around this part >300 AND <=600, where I would like say where "The value is greater than 300 But Less Than Or Equal to 600".

I've spent quite a while searching for a solution, but I've been unable to find one.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

javiergn — Thu, 04 Feb 2016 12:24:00 GMT

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

IRHM73 — Thu, 04 Feb 2016 12:39:19 GMT

Hi @javiergn, thank you for this, I knew it would be something simple.

Many thanks and kind regards

Chris