Find count of employees based on their experience range, 0-5, 5-10, 10-15, and 15-20

[SA2]

Hi there!

I am new to Splunk and i have a task that "Find count of employees based on their experience range, 0-5, 5-10, 10-15, and 15-20" from a company

I am try lot used by comparison operators but didn't get the answer, can you please help me in this?

[gcusello]

Hi @SA2,

if you have the experience in a field (called e.g. experience), you can use the eval command with the case option to tag the experiences, something like this:

your_search
| eval range=case(experience<6,"0-5", experience<11,"6-10", experience<16,"11-15", experience<21,"16-20", experience>20,">20")
| stats count BY range

Ciao.

Giuseppe

[SA2]

Thank you for your reply. i tried with query but its shows error like "Error in 'eval' command: Type checking failed. The '<' operator received different types".

Find the below query

index=hrdata| eval range=case("Age in Company _Years"<6,"0-5", "Age in Company _Years"<11,"6-10", "Age in Company _Years"<16,"11-15", "Age in Company _Years"<20,"16-20", "Age in Company _Years">20,">20") | stats count BY "range"

[gcusello · Accepted solution]

Hi @SA2,

try something like this:

index=hrdata
| rename "Age in Company _Years" AS age
| eval range=case(age<6,"0-5", age<11,"6-10", age<16,"11-15", age<21,"16-20", age>20,">20") 
| stats count BY range

It's never a good idea using spaces in field names.

Ciao.

Giuseppe

[SA2]

Thank you Sir, its working now

[gcusello]

Hi @SA2,

good for you and next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉