Splunk Search

Search Help- Not sure how to Title

Substance82
Path Finder

I'm trying to achieve the following output using the table command, but am hitting a snag. 

Vision ID Transactions Good % Good Fair % Fair Unacceptable % Unacceptable Average Response Time Report Date
ABC STORE (ABCD) 159666494 159564563 99.9361601 101413 0.063515518 518 0.000324426 0.103864001 Jul-24
Total 159666494 159564563 99.9361601 101413 0.063515518 518 0.000324426 0.103864001 Jul-24
                   
Thresholds   response <= 1s   1s < response <= 3s 3s < response      

Here is my broken query:

index=etims_na
sourcetype=etims_prod
platformId=5
bank_fiid = ABCD
| eval response_time=round(if(strftime(_time,"%Z") == "EDT",((j_timestamp-entry_timestamp)-14400000000)/1000000,((j_timestamp-entry_timestamp)-14400000000)/1000000-3600),3)
| stats count AS Total count(eval(response_time<=1)) AS "Good" count(eval(response_time<=2)) AS "Fair" count(eval(response_time>2)) AS "Unacceptable" avg(response_time) AS "Average" BY Vision_ID
| eval %Good= round((Good/total)*100,2), %Fair = round((Fair/total)*100,2), %Unacceptable = round((Unacceptable/total)*100,2)
| addinfo
| eval "Report Date"=strftime(info_min_time, "%m/%Y")
| table "Vision_ID", "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"

The help is always appreciated. Thanks!

Labels (3)
0 Karma
1 Solution

Substance82
Path Finder

Read my notes and kept trying until I got it! 

index=etims_na
sourcetype=etims_prod
platformId=5
bank_fiid=COST
| eval response_time=round(if(strftime(_time,"%Z") == "EDT",((j_timestamp-entry_timestamp)-14400000000)/1000000,((j_timestamp-entry_timestamp)-14400000000)/1000000-3600),3)
| stats count AS Transactions count(eval(response_time <= 1)) AS "Good" count(eval(response_time <= 2)) AS "Fair" count(eval(response_time > 2)) AS "Unacceptable" avg(response_time) AS "Average" BY bank_fiid
| eval "%Good"=(Good/Transactions)*100
| eval "%Fair"=(Fair/Transactions)*100
| eval "%Unacceptable"=(Unacceptable/Transactions)*100
| addinfo
| eval "Report Date"=strftime(info_min_time, "%m/%Y")
| table bank_fiid, "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"
| rename bank_fid as "Vision ID"

View solution in original post

Substance82
Path Finder

Read my notes and kept trying until I got it! 

index=etims_na
sourcetype=etims_prod
platformId=5
bank_fiid=COST
| eval response_time=round(if(strftime(_time,"%Z") == "EDT",((j_timestamp-entry_timestamp)-14400000000)/1000000,((j_timestamp-entry_timestamp)-14400000000)/1000000-3600),3)
| stats count AS Transactions count(eval(response_time <= 1)) AS "Good" count(eval(response_time <= 2)) AS "Fair" count(eval(response_time > 2)) AS "Unacceptable" avg(response_time) AS "Average" BY bank_fiid
| eval "%Good"=(Good/Transactions)*100
| eval "%Fair"=(Fair/Transactions)*100
| eval "%Unacceptable"=(Unacceptable/Transactions)*100
| addinfo
| eval "Report Date"=strftime(info_min_time, "%m/%Y")
| table bank_fiid, "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"
| rename bank_fid as "Vision ID"
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...