How to filter search result based on case condition

[andreigro]

Hi guys, I'm new to splunk and I have one issue with filtering my search results based on a case condition
My search string:
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

I now I need to filter this based on the field named host=selected_host

It doesn't sound very complex but I cannot make it work.
Thank you,
Andrei

[niketn]

May I know how you are setting $ddl_instance$ token?

It is most likely that eval can be used to set token at the same place for host directly. That way you will be able to add host in your base query hence resulting in filtering required results upfront rather than later. This should improve your search performance. (http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting)

In the current query you can change by host to by selected_host in your timechart command

sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by selected_host limit=20

[richgalloway · Accepted solution]

Try one of these.

sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | where host=selected_host | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

sourcetype="WMI:CPUTime" | where host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20

[andreigro]

Thanks a lot! Tried the first query and it worked!