All Apps and Add-ons

How to use "CASE" statements to get the results based on multiple conditions and multiple fields?

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

nickhills
Ultra Champion

Typed on a phone, so there may be errors, but would something like this work for you?

 ...|search QUEUE=message*
    |eval level=case((QUEUE=MESSAGE1 AND QueueDepth>=400 AND MessageAge>=400), "high", (QUEUE=MESSAGE2 AND QueueDepth>=200 AND MessageAge>=300), "high", (QUEUE=MESSAGE3 AND QueueDepth>=100 AND MessageAge>=300), "high",1=1,"other")
    |where level="high"
    |stats count by QUEUE
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...