Splunk Enterprise

Why is my case command with less than or equal to operator not categorizing correctly?

lrnr01
Observer

Hi All,

I have the below line of code to categorize transactions based on the response time (duration) taken in seconds.

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

Say i trigger a load test with 100 transactions which are  all taking between 1 to 3 Secs but surprisingly few txns say 1 to 4 txns out of 100 are NOT getting categorized in the table though their duration column has a value between 1 to 3 Secs. Can someone please let me know what is going wrong.

lrnr01_0-1648581733855.png

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Check if you're not having those values as strings. If so, you have to cast them to numbers by using tonumber().

0 Karma

lrnr01
Observer

@PickleRick , Thank you very much, that gave me a clue and i tried the below line (WORKED) and it worked.

| eval ranges=case(Duration<="1", "less", Duration>"1" AND Duration<="3", "between", Duration>"3", "greater")

INSTEAD OF (NOT WORKING)

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...