Can you help me with my eval statement question?

[Kendo213]

My results look like this:

ServerName count
ServerFarmA-1 47
ServerFarmA-2 49
ServerFarmB-1 16
ServerFarmB-2 15

Each server farm has two servers that should be load balanced. I basically want to take the count per server in a farm, divide it by the other number, and if it is relatively similar, (i.e. 47/49 = 95%) in the eval I will give it a status of 'Good', or 'Needs Attention' if it is at, as an example, 75%.

How can I go about doing this given the matching field names?

Thanks

[KailA · Accepted solution]

Hello,

What do you think about that

| makeresults 
| eval ServerName = "ServerFarmA-1", count=47 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmA-2", count=49] 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmB-1", count=16] 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmB-2", count=15]
| table ServerName,count
| rex field=ServerName "^(?<Farm>[^-]+")
| stats values(count) as count by Farm
| eval FirstServer = mvindex(count,0),
       SecondServer = mvindex(count,1),
       Percentage = (FirstServer / SecondServer)*100,
       State = case(Percentage>=0.95,"Good",
                    Percentage >=0.75,"Needs Attention",
                    true(),"Bad")

That give you the percentage by ServerFarm and after you ca you a case to assign the value you want to a percentage range 🙂

Let me know

Kail

---

Edit

If the count is equal between two server of the same farm

| makeresults 
| eval ServerName = "ServerFarmA-1", count=57 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmA-2", count=47] 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmB-1", count=16] 
| append 
    [| makeresults 
    | eval ServerName = "ServerFarmB-2", count=16] 
| table ServerName,count 
| rex field=ServerName "^(?<Farm>[^-]+") 
| stats list(count) as count by Farm 
| eval FirstServer = mvindex(count,0),
    SecondServer = mvindex(count,1),
    First = case(FirstServer > SecondServer,SecondServer,
    FirstServer < SecondServer, FirstServer,
    FirstServer = SecondServer, FirstServer),
    Second = case(SecondServer > FirstServer,SecondServer,
    SecondServer < FirstServer, FirstServer,
    FirstServer = SecondServer, SecondServer),
    Percentage = (First / Second)*100,
    State = case(Percentage>=0.95,"Good",
    Percentage >=0.75,"Needs Attention",
    true(),"Bad")

[Kendo213]

So one thing I've noticed is that if both servers have the same value, it's only passing the number of one of them (i.e. 15 is only listed once so it goes critical). Any ideas?

[KailA]

I edited my answer 🙂

[Kendo213]

Great! Thanks again

[KailA]

I edited it a second time, take the second search now, should be good 🙂

[Kendo213]

That's...exactly what I wanted. Thanks a ton.