Splunk Search

Greater Than & Less Than or Equal To

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've created the line below which is part of a bigger query.

|eval groupduration=case(duration<=300,"<5 minutes", >300 AND <=600, "Between 5 & 10 Minutes")

The problem I have is around this part >300 AND <=600, where I would like say where "The value is greater than 300 But Less Than Or Equal to 600".

I've spent quite a while searching for a solution, but I've been unable to find one.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

View solution in original post

javiergn
Super Champion

You are missing the duration variable in your second case statement:

|eval groupduration=case(duration<=300, "<5 minutes", duration>300 AND duration<=600, "Between 5 & 10 Minutes")

IRHM73
Motivator

Hi @javiergn, thank you for this, I knew it would be something simple.

Many thanks and kind regards

Chris

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...