Splunk Search

Is it possible for the chart command to not get executed unless cix is equal to the number 1?

bdh5574
New Member

I have the following search. What I would like is for the chart command to not get executed unless cix is equal to the number 1.
Is that possible? To have a conditional calculation?

| rename SMF70DTE as Date, SMF70TME as Time, SMF70SID as LPAR 
| eval IntervalTime=strftime(_time,"%H.%M")
| rex "SMF70CIX_\d{4}\":\"(?P<cix>[0-9.]+)\"" 
| rex "SMF70PDT_\d{4}\":\"(?P<pdt>[0-9.]+)\"" 
| chart sum(pdt) over IntervalTime by LPAR

Thanks, Bob

0 Karma

DalJeanis
Legend

After rex number 1 and before chart, insert this line

| search cix=1 

It doesn't really matter if it's before or after rex number 2, but before rex number 2 is slightly more efficient.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...