Splunk Search

Is it possible to do a conditional count using tstats?

Builder

Is it possible to do a conditional count using tstats? I'm trying use the following which is the syntax that I would use for a non tstats search, but it doesn't work. count(eval("Performance.duration" > 2500)) AS violation

Complete search:

| tstats  count(eval("Performance.duration" > 2500)) AS violation exactperc99("Performance.duration") AS "perc99"  from datamodel=PerformanceMetrics where (nodename = PerformanceMetricBaseSearch)  (PerformanceMetricBaseSearch.duration="*")   groupby PerformanceMetric _time span=15m 

Path Finder

Here's how I did it without changing the data model.

My goal was to see what percentage of API calls returned in under 1 second and under 3 seconds.

| tstats summariesonly=t prestats=t count from datamodel=rest_api 
       BY object.apiName
| eval perfThreshold="Total"
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api 
       WHERE object.responseTime<=1000
       BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below1sec")
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api 
       WHERE object.responseTime<=3000
       BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below3sec")
| rename object.* as *
| chart count by apiName perfThreshold
| eval pctBelow1Sec=100 * Below1sec / Total
| eval pctBelow3Sec=100 * Below3sec / Total
| table apiName pctBelow1Sec pctBelow3Sec Total

Hope this helps.

0 Karma

Builder

I have been able to do this with adding another tstats string using append=true, however curious if it can be done without having to do that

0 Karma

Explorer

@cramasta - do you think you could post an example?

0 Karma

Legend

One way you could try is add a new field to your datamodel. eval newfield=if("Performance.duration" > 2500, 1, 0) and in your search do | tstats sum(newfield) as violation

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!