Dashboards & Visualizations

Wildcard text in a sum(eval(if script

crmarley20
Explorer

Hi, 

I need to sum the values of durations found in the Duration_of_Errors column of each error that occur in a user in a certain work shift of the day. I am using the stats command.

It happens that the names of my errors start like this:
Technical/broken screen
Technical/keyboard crashed
...
Organizational/absence of personnel
Organizational/change of office
.....
Quality/Audit
Quality/server migration
.....

I want to sum the duration of each group of errors per shift and user I have used this but I can't get it to sum, what am I doing wrong?

| stats sum(eval(if(Error_Text="Technical*"))) as sum_technical_duration_errors by shift user 

 

Thanks in advance!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...