All Apps and Add-ons
Highlighted

How to use "CASE" statements to get the results based on multiple conditions and multiple fields?

New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma
Highlighted

Re: How to use "CASE" statements to get the results based on multiple conditions and multiple fields?

Ultra Champion

Typed on a phone, so there may be errors, but would something like this work for you?

 ...|search QUEUE=message*
    |eval level=case((QUEUE=MESSAGE1 AND QueueDepth>=400 AND MessageAge>=400), "high", (QUEUE=MESSAGE2 AND QueueDepth>=200 AND MessageAge>=300), "high", (QUEUE=MESSAGE3 AND QueueDepth>=100 AND MessageAge>=300), "high",1=1,"other")
    |where level="high"
    |stats count by QUEUE
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.