Is it possible to do a conditional count using tstats?

[cramasta]

Is it possible to do a conditional count using tstats? I'm trying use the following which is the syntax that I would use for a non tstats search, but it doesn't work. count(eval("Performance.duration" > 2500)) AS violation

Complete search:

| tstats  count(eval("Performance.duration" > 2500)) AS violation exactperc99("Performance.duration") AS "perc99"  from datamodel=PerformanceMetrics where (nodename = PerformanceMetricBaseSearch)  (PerformanceMetricBaseSearch.duration="*")   groupby PerformanceMetric _time span=15m 

[Kenshiro70]

Here's how I did it without changing the data model.

My goal was to see what percentage of API calls returned in under 1 second and under 3 seconds.

| tstats summariesonly=t prestats=t count from datamodel=rest_api 
       BY object.apiName
| eval perfThreshold="Total"
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api 
       WHERE object.responseTime<=1000
       BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below1sec")
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api 
       WHERE object.responseTime<=3000
       BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below3sec")
| rename object.* as *
| chart count by apiName perfThreshold
| eval pctBelow1Sec=100 * Below1sec / Total
| eval pctBelow3Sec=100 * Below3sec / Total
| table apiName pctBelow1Sec pctBelow3Sec Total

Hope this helps.

[cramasta]

I have been able to do this with adding another tstats string using append=true, however curious if it can be done without having to do that

[pwmcintyre]

@cramasta - do you think you could post an example?

[sundareshr]

One way you could try is add a new field to your datamodel. eval newfield=if("Performance.duration" > 2500, 1, 0) and in your search do | tstats sum(newfield) as violation