Dashboards & Visualizations

Wildcard text in a sum(eval(if script

crmarley20
Explorer

Hi, 

I need to sum the values of durations found in the Duration_of_Errors column of each error that occur in a user in a certain work shift of the day. I am using the stats command.

It happens that the names of my errors start like this:
Technical/broken screen
Technical/keyboard crashed
...
Organizational/absence of personnel
Organizational/change of office
.....
Quality/Audit
Quality/server migration
.....

I want to sum the duration of each group of errors per shift and user I have used this but I can't get it to sum, what am I doing wrong?

| stats sum(eval(if(Error_Text="Technical*"))) as sum_technical_duration_errors by shift user 

 

Thanks in advance!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...