Dashboards & Visualizations

CASE statement not returning required output

schou87
Path Finder

Hi,

I need my output as below

Date     Greater than 12Hrs    Greater than 24Hrs    Greater than 48Hrs    Greater than 72Hrs

Below is my query

base_query | eval Final_TIME=CASE(TOTAL_TIME>12, "Greater than 12Hrs", TOTAL_TIME>24, "Greater than 24Hrs", TOTAL_TIME>48, "Greater than 48Hrs", TOTAL_TIME>72, "Greater than 72Hrs") | CHART COUNT OVER Date BY Final_TIME | sort - Date | eval Date=strftime(strptime(Date,"%Y-%m-%d"),"%m-%d-%Y") | head 7 | addtotals

My query is only returning 

Date     Greater than 12Hrs   NULL

 

Please help.

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Case is evaluated left to right so you could try reordering the comparisons

base_query | eval Final_TIME=CASE(TOTAL_TIME>72, "Greater than 72Hrs", TOTAL_TIME>48, "Greater than 48Hrs", TOTAL_TIME>24, "Greater than 24Hrs", TOTAL_TIME>12, "Greater than 12Hrs") | CHART COUNT OVER Date BY Final_TIME | sort - Date | eval Date=strftime(strptime(Date,"%Y-%m-%d"),"%m-%d-%Y") | head 7 | addtotals
0 Karma

schou87
Path Finder

Hi @ITWhisperer 

I am still getting the NULL field and its giving me wrong data. I don't see the "Greater than 72Hrs" field.

Date  Greater than 12Hrs  Greater than 24Hrs  Greater than 48Hrs  NULL  Total

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The NULL is there because you didn't include a value for TOTAL_TIME <= 12, or else in the case function.

base_query | eval Final_TIME=CASE(TOTAL_TIME>72, "Greater than 72Hrs", TOTAL_TIME>48, "Greater than 48Hrs", TOTAL_TIME>24, "Greater than 24Hrs", TOTAL_TIME>12, "Greater than 12Hrs", 1==1, "Less than 12Hrs") | CHART COUNT OVER Date BY Final_TIME | sort - Date | eval Date=strftime(strptime(Date,"%Y-%m-%d"),"%m-%d-%Y") | head 7 | addtotals

Apart from that, the counts will be based on the value of TOTAL_TIME. If the counts are wrong, check that TOTAL_TIME is as you expect it to be. Try running the search on a smaller data set so you can check it.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@schou87 

Can you please try this?

base_query TOTAL_TIME=* 

And rest of the search provided by @ITWhisperer .

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...