Getting Data In

if-else statement with timeframe

shreyad
Explorer

I would like to specify my search to return a previous months + the current months data if the count outputted by just the current months data is less than 0. How would I do that?

Right now I have earliest = @mon for the current months data. How do I implement the if else statement?

I have this right now. Would this be in the first pipe?
eval (if count(data) <=0, earliest= -1mon@mon, else earliest=@mon )

0 Karma

woodcock
Esteemed Legend

Like this:

Index=YouShouldAlwaysSpeciryINdex AND sourcetype=AndSourcetypeToo AND other stuff here
earliest = -1mon@mon latest=@s
| bucket _time span=1mon
| stats sum(YourFieldWithValuesHere) AS monthlyCount BY _time
| transpose
| tail 1
| eval count = if('row 2' <=0, 'row 1', 'row 2')
| table count
0 Karma

DalJeanis
Legend

A count cannot be less than zero. What are you trying to achieve?

In general, my approach would be to calculate the two items, then throw away the unwanted if the test is not met. Eventstats is useful for generating aggregations for that test. Here's one way to do that, in pseudocode...

 your search that gets all the data
 | eval  myflag= if (the event is this month,"Now","Before")
 | eventstats ... some aggregate command that adds up whatever you want to test for this month...
 | where myflag="Before" OR some test on the aggregate
 | the rest of your logic

If you only want the aggregated data, then use an actual stats command instead of eventstats, and add myflag as one of the group by fields.

0 Karma

somesoni2
Revered Legend

If your base search only includes metadata fields (host/index/source/sourcetype ) or any index-time extracted fields, you can run something like this

index=foo sourcetype=bar  [| tstats count WHERE index=foo sourcetype=bar earliest=@mon | eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] |....rest of the search

niketn
Legend

@shreyad, what have you tried so far? Also what does the base search looks like for you? Is it based on only metadata fields like index sourcetype etc. or does it involve other Search Time extracted fields as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

shreyad
Explorer

There is an index, sourcetype and host. All I have tried is what I posted and "earliest = @mon." But that does not solve my issue of wanting to output the previous months data iff the count of the current month is <=0.

0 Karma

somesoni2
Revered Legend

What search are you running?

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...