Splunk Search

How to use a conditional variable in a stats count command?

Builder

Given the following search logic

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
| bin _time span=1d
| stats count as Total, count(eval(DurationTotal>$ActionSLA$) AS Latent by _time Action
| eval Percent=round(100-((Latent*100)/Total),2)

I want to have the $ActionSLA$ variable in the above pseudocode be different for each action so that I end up with results that look like the following where the Latent field is driven by the ActionSLA per Action. For instance Search ActionSLA=2000 when Action=Search, ActionSLA=4000 when Action=CreateOrder, etc.

_time              Action              Total    Latent  Percent
2017-01-26 09:00    Confirm           1259   864       31.37
2017-01-26 09:00    CreateOrder       611     147      75.94
2017-01-26 09:00    CreditRefund_Confirm 333      237      28.83
2017-01-26 09:00    FindItinerary       12461   2155      82.71
2017-01-26 09:00    Search             8349  3481     58.31
1 Solution

Revered Legend

Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
 | bin _time span=1d 
| eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0)
 | stats count as Total, sum(Latest) as Latent by _time Action
 | eval Percent=round(100-((Latent*100)/Total),2)

View solution in original post

0 Karma

Revered Legend

Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
 | bin _time span=1d 
| eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0)
 | stats count as Total, sum(Latest) as Latent by _time Action
 | eval Percent=round(100-((Latent*100)/Total),2)

View solution in original post

0 Karma

Builder

Ha, this is exactly what I was thinking of doing as well, but the syntax was throwing me. This did in fact work, thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!