Dashboards & Visualizations

Wildcard text in a sum(eval(if script

crmarley20
Explorer

Hi, 

I need to sum the values of durations found in the Duration_of_Errors column of each error that occur in a user in a certain work shift of the day. I am using the stats command.

It happens that the names of my errors start like this:
Technical/broken screen
Technical/keyboard crashed
...
Organizational/absence of personnel
Organizational/change of office
.....
Quality/Audit
Quality/server migration
.....

I want to sum the duration of each group of errors per shift and user I have used this but I can't get it to sum, what am I doing wrong?

| stats sum(eval(if(Error_Text="Technical*"))) as sum_technical_duration_errors by shift user 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...