Reporting

How can I use multiple fields and values by different fields of time?

hyungjoon
New Member

alt text

Hello,

Here is my question:

Suppose I have 4 fields, and I want to find the recorded time of each step using conditions of the fields.

But, because there is different time and multiple fields involved, I cannot seem to get the result I want

can someone please help me?

Tags (1)
0 Karma

kmaron
Motivator

try this:

| eval step1_time = case(jobtype=delivery AND status=pending,Time1)
| eval step2_time = case(jobtype=delivery AND status=pending,Time1)
| eval step3_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2)
| eval step4_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2)
| eval step5_time = case(jobtype=delivery AND status=deposited,Time2)
| eval step6_time = case(jobtype=delivery AND status=deposit_failed,Time2)
| stats earliest(step1_time) as step1 latest(step2_time) as step2 earliest(step3_time) as step3 latest(step4_time) as step4 earliest(step5_time) as step5 latest(step6_time) as step6
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...