Splunk Search

Greater Than & Less Than or Equal To

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've created the line below which is part of a bigger query.

|eval groupduration=case(duration<=300,"<5 minutes", >300 AND <=600, "Between 5 & 10 Minutes")

The problem I have is around this part >300 AND <=600, where I would like say where "The value is greater than 300 But Less Than Or Equal to 600".

I've spent quite a while searching for a solution, but I've been unable to find one.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

View solution in original post

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

IRHM73
Motivator

Hi @javiergn, thank you for this, I knew it would be something simple.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...