Splunk Enterprise

Why is my case command with less than or equal to operator not categorizing correctly?

lrnr01
Observer

Hi All,

I have the below line of code to categorize transactions based on the response time (duration) taken in seconds.

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

Say i trigger a load test with 100 transactions which are  all taking between 1 to 3 Secs but surprisingly few txns say 1 to 4 txns out of 100 are NOT getting categorized in the table though their duration column has a value between 1 to 3 Secs. Can someone please let me know what is going wrong.

lrnr01_0-1648581733855.png

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Check if you're not having those values as strings. If so, you have to cast them to numbers by using tonumber().

0 Karma

lrnr01
Observer

@PickleRick , Thank you very much, that gave me a clue and i tried the below line (WORKED) and it worked.

| eval ranges=case(Duration<="1", "less", Duration>"1" AND Duration<="3", "between", Duration>"3", "greater")

INSTEAD OF (NOT WORKING)

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...