Splunk Search

Greater Than & Less Than or Equal To

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've created the line below which is part of a bigger query.

|eval groupduration=case(duration<=300,"<5 minutes", >300 AND <=600, "Between 5 & 10 Minutes")

The problem I have is around this part >300 AND <=600, where I would like say where "The value is greater than 300 But Less Than Or Equal to 600".

I've spent quite a while searching for a solution, but I've been unable to find one.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

View solution in original post

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

IRHM73
Motivator

Hi @javiergn, thank you for this, I knew it would be something simple.

Many thanks and kind regards

Chris

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...