Dashboards & Visualizations

Wildcard text in a sum(eval(if script

crmarley20
Explorer

Hi, 

I need to sum the values of durations found in the Duration_of_Errors column of each error that occur in a user in a certain work shift of the day. I am using the stats command.

It happens that the names of my errors start like this:
Technical/broken screen
Technical/keyboard crashed
...
Organizational/absence of personnel
Organizational/change of office
.....
Quality/Audit
Quality/server migration
.....

I want to sum the duration of each group of errors per shift and user I have used this but I can't get it to sum, what am I doing wrong?

| stats sum(eval(if(Error_Text="Technical*"))) as sum_technical_duration_errors by shift user 

 

Thanks in advance!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...