Dashboards & Visualizations

IF/CASE for multiple variables

klaudiac
Path Finder

Hi guys, 

Looking for a bit of help because I confused myself at this point and can't think logically 😞

I'm creating a search where I can show uploads vs downloads, and the criteria is as follow:

*if bytes_in (download) is more than 70% of all the bytes for that user, then the main action is data download and I want to add a column "alert" with a value "download"

*if bytes_out (upload) is more than 70% of all the bytes for that user, then the main action is data upload and I want to add to the column "alert" that it's going to be an "upload" 

*if the bytes in and our are within 20% of the even split, then the value in the "alert" column will be no action.
if the split is even, then "no action". 


Now, how do I do it in Splunk?? 

Labels (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust
index=indexName
| eval user_bytes_perc_download = (bytes_in/all_bytes_user)*100
| eval user_bytes_perc_upload = (bytes_out/all_bytes_user)*100
| eval alert=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <20 AND user_bytes_perc_upload < 20, "no action")

if the bytes in and our are within 20% of the even split -  I got confused with this, so the query is as per my understanding. 

View solution in original post

inventsekar
SplunkTrust
SplunkTrust
index=indexName
| eval user_bytes_perc_download = (bytes_in/all_bytes_user)*100
| eval user_bytes_perc_upload = (bytes_out/all_bytes_user)*100
| eval alert=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <20 AND user_bytes_perc_upload < 20, "no action")

if the bytes in and our are within 20% of the even split -  I got confused with this, so the query is as per my understanding. 

klaudiac
Path Finder

Nevermind - I have it 🙂 

Thanks so much for your help! 

0 Karma

klaudiac
Path Finder

Thanks so much, almost there 🙂
I should have specified better - the equal split would be 50-50% between in and out.  So anything that's within the 30% (not 20 - sorry, I'm losing it today) margin would be "no action" e.g. 60% are uploads and  40% are downloads = "no action" 

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...