Can I search eval case inside map?

[winknotes]

Nothing is returned for SOT (assuming NULL).  I don't understand what could be wrong.  If I run the mstats command as a standalone search it works as expected so I'm guessing it's because it's inside this map command?  

|inputlookup blah.csv
| dedup ArrayName
| map maxsearches=1000 search="
  |mstats avg(some.statistic) WHERE index=myindex AND Array_Name=$ArrayName$ by sgname Array_Name Model
  |eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
  | sort - PctIOPS
  | head 5
  | table Array_Name Model SOT sgname PctIOPS

[richgalloway · Accepted solution]

I'll let someone else comment on how mstats works with map.  I have an alternative query to try.

| mstats avg(some.statistic) WHERE index=myindex AND [|inputlookup blah.csv
| dedup ArrayName | fields ArrayName | format ] by sgname Array_Name Model
| eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
| sort - PctIOPS
| head 5
| table Array_Name Model SOT sgname PctIOPS

[winknotes]

That works great.  Now is there also a way to grab a couple more values per ArrayName out of the lookup file?  

So instead of the table command being:

| table Array_Name Model SOT sgname PctIOPS

it might be:

| table Array_Name Model SOT sgname PctIOPS avgIOPS avg_pred_IOPS

 Where avgIOPS and avg_pred_IOPS are fields in the lookup file?  

[richgalloway]

Change the fields command in the subsearch to return the desired fields.  Splunk will expect to find all of the named fields in each event.  Also, the names must match what is in the index.  If they don't match then insert a rename command before format.

[winknotes]

Yes I did use a rename.  This is what I'm trying but it doesn't find any results now.  The fields command adds an 'AND' to the parenthetical filtering (Array_Name="x" AND avgIOPS=123)

| fields ArrayName avgIOPS
| rename ArrayName as Array_Name 
| format ]

[richgalloway]

Yup, that's what I said it would do.  If you need to use OR instead of AND then the format command will let you do so.  See the Search Reference Manual for details.

[isoutamo]

Hi

You can use

| format "(" "" "OR" "" "" ")"

or change "(" and ")" to ""

r. Ismo