Dashboards & Visualizations

Wildcard text in a sum(eval(if script

crmarley20
Explorer

Hi, 

I need to sum the values of durations found in the Duration_of_Errors column of each error that occur in a user in a certain work shift of the day. I am using the stats command.

It happens that the names of my errors start like this:
Technical/broken screen
Technical/keyboard crashed
...
Organizational/absence of personnel
Organizational/change of office
.....
Quality/Audit
Quality/server migration
.....

I want to sum the duration of each group of errors per shift and user I have used this but I can't get it to sum, what am I doing wrong?

| stats sum(eval(if(Error_Text="Technical*"))) as sum_technical_duration_errors by shift user 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...