Dashboards & Visualizations

how to use the values returned by mvindex in the query

anooshac
Communicator

Hi all,

I have a token "range" which is in the format 0-2, 2-5, 5-10, 10-100 .. I am splitting it by "-" and saving the the values as "minor" and "major". When i try to use those values in the query i am not able to get the results. The query is as follows.

search index= "abc" sourcetype="xyz"| eval range = "$time$"| eval temp=split(range,"-")| eval minor=mvindex(temp,0)| eval major=mvindex(temp,1)|search duration>minor AND duration<=major| table task duration URL

I am not able to display the table. Can anyone please help me in this.

Labels (3)
Tags (4)
0 Karma
1 Solution

Software-Simian
Path Finder

Try this out:

index=_audit source=audittrail sourcetype=audittrail info=completed
| eval range = "0-2"
| eval var = split(range,"-")
| eval low = mvindex(var,0)
| eval high = mvindex(var,1)
| eval total_run_time=round(total_run_time/60,2)
| stats sum(total_run_time) AS Total_Min by user low high
| where Total_Min>low AND Total_Min<high

View solution in original post

0 Karma

Software-Simian
Path Finder

Try this out:

index=_audit source=audittrail sourcetype=audittrail info=completed
| eval range = "0-2"
| eval var = split(range,"-")
| eval low = mvindex(var,0)
| eval high = mvindex(var,1)
| eval total_run_time=round(total_run_time/60,2)
| stats sum(total_run_time) AS Total_Min by user low high
| where Total_Min>low AND Total_Min<high

0 Karma

anooshac
Communicator

thank you so much it is working properly now. Can you please tell me what was the mistake i did there?

0 Karma

Software-Simian
Path Finder

Hi,

 

i assume that you did not get any results because you used search instead of where.

 

Try your code with "where"...might already do the trick.

 

Regards,

Mike

0 Karma

anooshac
Communicator

Oh yes.. i used search.. thank you!

0 Karma

Software-Simian
Path Finder

Hi,

 

one major question stands in the room. Is the content you apply split to:

0-2, 2-5, 5-10, 10-100

OR is it:

0-2

2-5

etc.

?

0 Karma

anooshac
Communicator

I have to split 0-2 into 0 and 2. I just mentioned remaining as examples for the values for the token.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...