Splunk Search

Apply different calculation count/sum depending on value/index

martinmasif
Explorer

I have a "cost" for two different indexes that I want to calculate in one and the same SPL. As the "price" is different depending on index, I can't just use a "by" clause in my count/sum as I don't know how to apply the separate costs in that way.

Let's say...

idxCheap costs $10 per event.

idxExpensive costs $20 per event.

I've written this SPL that works, although the "cost" data ends up in a unique column for each index. The count is still in the same column.

index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCheapCost = case(index="idxCheap", count*10)
| eval idxExpensiveCost = case(index="idxExpensive", count*20)

 The results looks like this:

count idxCheapCost idxExpensiveCost index

44892448920 idxCheap
155 3100idxExpensive

 

Any pointers on how to most efficiently and dynamically achieve this?

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're close.  Combine the case functions to produce a single expense field.

index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCost = case(index="idxCheap", count*10, index="idxExpensive", count*20)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're close.  Combine the case functions to produce a single expense field.

index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCost = case(index="idxCheap", count*10, index="idxExpensive", count*20)

 

---
If this reply helps you, Karma would be appreciated.

martinmasif
Explorer

Haha why did I even split it up on two rows?!

Thanks!

 

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...