Splunk Search

Need Help with a Splunk Search and modifying thresholds based don day and time?

phularah
Communicator

I am trying to modify Thresholds based on the day and time. I have the chart completed, just need help with the thresholds.
If the day is Saturday or Sunday and host is a1, Threshold should be 1, if host is a2 with same timing conditions, threshold should be 1.5 and for other remaining hosts threshold should be 0.5 with same timing conditions.

If the day is Monday-Friday, and time is between 12:00am to 12:pm, for host a1 threshold should be 3, and for same timing conditions for host a2 threshold should be 4 and for other remaining hosts threshold should be 1 with same timing conditions.

The search that I am trying is something like as shown below, but there are multiple hosts and it is not working for a single host and I need to change thresholds based on time of that particular day as well.


| eval Threshold = case (if(strftime(_time,"%a")="Sat" AND host="a1"), Threshold=1, if(strftime(_time,"%a")=Sun AND host="a1"), Threshold=1, if(strftime(_time,"%a")="Sun" AND host="a2"), Threshold=1.5, if(strftime(_time,"%a")="Sun" AND host="a2"), Threshold=1.5)

Labels (3)
1 Solution

phularah
Communicator

 

| eval Threshold = case(strftime(_time,"%a")="Sat" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a2",1.5, strftime(_time,"%a")="Sun" AND host="a2",1.5)

It worked. Thanks gcusello.

 

View solution in original post

0 Karma

phularah
Communicator

 

| eval Threshold = case(strftime(_time,"%a")="Sat" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a2",1.5, strftime(_time,"%a")="Sun" AND host="a2",1.5)

It worked. Thanks gcusello.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

you could create a lookup containing the conditions and the threshold: day, host, threshold,

then you could add to you search the lookup like this following:

<your_search>
| lookup thresholds.csv day host OUTPUT_threshold
| ...

In this way you can easily manage all the conditions.

Ciao.

Giuseppe

phularah
Communicator

I need help with case, if and strftime functions. I am doing something wrong and getting error that arguments to the if function are invalid.
I have used various permutations and combinations with strptime and strftime as well.

Also, the threshold needs to be changed depending on the time of the day.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

you don't need to use case and if, try this:

| eval Threshold = case(strftime(_time,"%a")="Sat" AND host="a1", Threshold=1, strftime(_time,"%a")="Sun" AND host="a1", Threshold=1, strftime(_time,"%a")="Sun" AND host="a2", Threshold=1.5, strftime(_time,"%a")="Sun" AND host="a2", Threshold=1.5)

Then use always quotes for each strings.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...