Splunk Search

Can I search eval case inside map?

winknotes
Path Finder

 

Nothing is returned for SOT (assuming NULL).  I don't understand what could be wrong.  If I run the mstats command as a standalone search it works as expected so I'm guessing it's because it's inside this map command?  

 

|inputlookup blah.csv
| dedup ArrayName
| map maxsearches=1000 search="
  |mstats avg(some.statistic) WHERE index=myindex AND Array_Name=$ArrayName$ by sgname Array_Name Model
  |eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
  | sort - PctIOPS
  | head 5
  | table Array_Name Model SOT sgname PctIOPS

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'll let someone else comment on how mstats works with map.  I have an alternative query to try.

| mstats avg(some.statistic) WHERE index=myindex AND [|inputlookup blah.csv
| dedup ArrayName | fields ArrayName | format ] by sgname Array_Name Model
| eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
| sort - PctIOPS
| head 5
| table Array_Name Model SOT sgname PctIOPS

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'll let someone else comment on how mstats works with map.  I have an alternative query to try.

| mstats avg(some.statistic) WHERE index=myindex AND [|inputlookup blah.csv
| dedup ArrayName | fields ArrayName | format ] by sgname Array_Name Model
| eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
| sort - PctIOPS
| head 5
| table Array_Name Model SOT sgname PctIOPS

 

---
If this reply helps you, Karma would be appreciated.

winknotes
Path Finder

That works great.  Now is there also a way to grab a couple more values per ArrayName out of the lookup file?  

So instead of the table command being:

| table Array_Name Model SOT sgname PctIOPS

it might be:

| table Array_Name Model SOT sgname PctIOPS avgIOPS avg_pred_IOPS

 Where avgIOPS and avg_pred_IOPS are fields in the lookup file?  

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change the fields command in the subsearch to return the desired fields.  Splunk will expect to find all of the named fields in each event.  Also, the names must match what is in the index.  If they don't match then insert a rename command before format.

---
If this reply helps you, Karma would be appreciated.
0 Karma

winknotes
Path Finder

Yes I did use a rename.  This is what I'm trying but it doesn't find any results now.  The fields command adds an 'AND' to the parenthetical filtering (Array_Name="x" AND avgIOPS=123)

| fields ArrayName avgIOPS
| rename ArrayName as Array_Name 
| format ]

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yup, that's what I said it would do.  If you need to use OR instead of AND then the format command will let you do so.  See the Search Reference Manual for details.

---
If this reply helps you, Karma would be appreciated.

isoutamo
SplunkTrust
SplunkTrust

Hi

You can use

| format "(" "" "OR" "" "" ")"

or change "(" and ")" to ""

r. Ismo

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...