Splunk Enterprise

Why is my case command with less than or equal to operator not categorizing correctly?

lrnr01
Observer

Hi All,

I have the below line of code to categorize transactions based on the response time (duration) taken in seconds.

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

Say i trigger a load test with 100 transactions which are  all taking between 1 to 3 Secs but surprisingly few txns say 1 to 4 txns out of 100 are NOT getting categorized in the table though their duration column has a value between 1 to 3 Secs. Can someone please let me know what is going wrong.

lrnr01_0-1648581733855.png

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Check if you're not having those values as strings. If so, you have to cast them to numbers by using tonumber().

0 Karma

lrnr01
Observer

@PickleRick , Thank you very much, that gave me a clue and i tried the below line (WORKED) and it worked.

| eval ranges=case(Duration<="1", "less", Duration>"1" AND Duration<="3", "between", Duration>"3", "greater")

INSTEAD OF (NOT WORKING)

| eval ranges=case(Duration<=1,"less",Duration>1 and Duration<=3,"between",Duration>3,"greater")

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...