Dashboards & Visualizations

IF/CASE for multiple variables

klaudiac
Path Finder

Hi guys, 

Looking for a bit of help because I confused myself at this point and can't think logically 😞

I'm creating a search where I can show uploads vs downloads, and the criteria is as follow:

*if bytes_in (download) is more than 70% of all the bytes for that user, then the main action is data download and I want to add a column "alert" with a value "download"

*if bytes_out (upload) is more than 70% of all the bytes for that user, then the main action is data upload and I want to add to the column "alert" that it's going to be an "upload" 

*if the bytes in and our are within 20% of the even split, then the value in the "alert" column will be no action.
if the split is even, then "no action". 


Now, how do I do it in Splunk?? 

Labels (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust
index=indexName
| eval user_bytes_perc_download = (bytes_in/all_bytes_user)*100
| eval user_bytes_perc_upload = (bytes_out/all_bytes_user)*100
| eval alert=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <20 AND user_bytes_perc_upload < 20, "no action")

if the bytes in and our are within 20% of the even split -  I got confused with this, so the query is as per my understanding. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust
index=indexName
| eval user_bytes_perc_download = (bytes_in/all_bytes_user)*100
| eval user_bytes_perc_upload = (bytes_out/all_bytes_user)*100
| eval alert=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <20 AND user_bytes_perc_upload < 20, "no action")

if the bytes in and our are within 20% of the even split -  I got confused with this, so the query is as per my understanding. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

klaudiac
Path Finder

Nevermind - I have it 🙂 

Thanks so much for your help! 

0 Karma

klaudiac
Path Finder

Thanks so much, almost there 🙂
I should have specified better - the equal split would be 50-50% between in and out.  So anything that's within the 30% (not 20 - sorry, I'm losing it today) margin would be "no action" e.g. 60% are uploads and  40% are downloads = "no action" 

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...