How do I edit my search to sort performance logs from one set of servers into one category, and everything else into another category?

[ShagVT]

I'm trying to write a search that will look at performance logs for my servers, putting the data from one set of servers into one bin, and everything else into a second bin.

Here's my attempt:

index=myindex sourcetype=performance_file ExecutionTime | eval category=(host="host1" OR host="host2" OR host="host3" OR host="host4", "SpecialServers", host!="host1" AND host!="host2" AND host!="host3" AND host!="host4", "OtherServers") | timechart span=1m avg(resptime) by category

I'm surprised by the error I'm getting:

Error in 'eval' command: The expression is malformed. Expected ).

Am I on the right track at all? I'm a bit of a rookie at advanced queries like this.

[javiergn]

You forgot the "case" and the double =

eval category = case(host ...

take a look at example 11 here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

[MattZerfas]

No need for a case if he just wants 2 groups of items. If he wanted 3 or more then a case statement would work better than an if statement.

[javiergn]

True. I didn't notice there were just two groups. Just saw a long eval and "assumed" there were more.

[MattZerfas]

Yup I did the same thing until I read through his query 🙂 All good.

[MattZerfas · Accepted solution]

Try This

index=myindex sourcetype=performance_file ExecutionTime | eval category=if(host="host1" OR host="host2" OR host="host3" OR host="host4", "SpecialServers", "OtherServers") | timechart span=1m avg(resptime) by category

You were on the right track but I just modified your eval to use an if statement.

Here is the link with the syntax for if statements and many others.
http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions