Splunk Search

Find count of employees based on their experience range, 0-5, 5-10, 10-15, and 15-20

SA2
Explorer

Hi there!

I am new to Splunk and i have a task that "Find count of employees based on their experience range, 0-5, 5-10, 10-15, and 15-20" from a company

I am try lot used by comparison operators but didn't get the answer, can you please help me in this?

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SA2,

try something like this:

index=hrdata
| rename "Age in Company _Years" AS age
| eval range=case(age<6,"0-5", age<11,"6-10", age<16,"11-15", age<21,"16-20", age>20,">20") 
| stats count BY range

It's never a good idea using spaces in field names.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SA2,

if you have the experience in a field (called e.g. experience), you can use the eval command with the case option to tag the experiences, something like this:

your_search
| eval range=case(experience<6,"0-5", experience<11,"6-10", experience<16,"11-15", experience<21,"16-20", experience>20,">20")
| stats count BY range

Ciao.

Giuseppe

SA2
Explorer

Thank you for your reply. i tried with query but its shows error like "Error in 'eval' command: Type checking failed. The '<' operator received different types".

Find the below query

index=hrdata| eval range=case("Age in Company _Years"<6,"0-5", "Age in Company _Years"<11,"6-10", "Age in Company _Years"<16,"11-15", "Age in Company _Years"<20,"16-20", "Age in Company _Years">20,">20") | stats count BY "range"

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SA2,

try something like this:

index=hrdata
| rename "Age in Company _Years" AS age
| eval range=case(age<6,"0-5", age<11,"6-10", age<16,"11-15", age<21,"16-20", age>20,">20") 
| stats count BY range

It's never a good idea using spaces in field names.

Ciao.

Giuseppe

SA2
Explorer

Thank you Sir, its working now

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SA2,

good for you and next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...