Splunk Search

Issue with if()?

Builder

Hey everyone. I am working to try and take a call record, subtract the time a call was placed from the time it was answered. This much works. After that I am trying to take the resulting number, and if its less than 30 eval it into another column. Here's the code:

index="sandbox" sourcetype="AS-CDR" 
|where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswerTest=if((TimeToAnswer<"30"),1,0)
|table TimeToAnswer TimeToAnswerTest

For some of the calls a result of 1 is seen when it should be. However for others, it isn't. Here are some example values that I'm getting back:

TimeToAnswer~TimeToAnswerTest 67.151000~0 (correct) 8.930000~0 (incorrect) 2.568000~1 (correct) 5.115000~0 (incorrect) 3.341000~1 (correct)

Any advice on what could be causing this would be extremely helpful. The numbers are being generated correctly, so I'm not sure why the if operator isn't always working correctly.

Tags (1)
0 Karma
1 Solution

Communicator

I believe it is the "s around the 30.

Try

index="sandbox" sourcetype="AS-CDR" 
|where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswerTest=if((TimeToAnswer<30),1,0)
|table TimeToAnswer TimeToAnswerTest

View solution in original post

Communicator

I believe it is the "s around the 30.

Try

index="sandbox" sourcetype="AS-CDR" 
|where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswerTest=if((TimeToAnswer<30),1,0)
|table TimeToAnswer TimeToAnswerTest

View solution in original post

Splunk Employee
Splunk Employee

The rule regarding strings vs numbers in quotes is true in most where and eval statements, but not in search statements.

0 Karma

Communicator

I'm guessing that's the case, it certainly sounds sensible. I'm afraid I'm a newbie too though. FYI, those brackets around the test are also unnecessary.

0 Karma

Builder

That worked perfectly. When you use quotes, does splunk process the contents of the quotes as a string as opposed to an integer/float?

0 Karma