Splunk Search

What syntax can I use to run a search that sorts varying runtimes?

JyotiP
Path Finder

I have data for 1 day where I want to sort it with activity like following manner, total number of records took 0-3 sec , total number of records took 3-4 and goes on. Want to present it in one query.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

There are two basic syntaxes you can use (probably a dozen more, but these two demonstrate the top two in use)

your query here 
| eval mygroup=case(Val_value>=0 AND Val_value<=3,"0.0 to 3.0", 
    Val_value>3 AND Val_value<=4,"3.0+ to 4.0", 
    Val_value>4 AND Val_value<=5,"4.0+ to 5.0", 
    Val_value>5 AND Val_value<=6,"5.0+ to 6.0", 
    true(),"6.0+")

...then your choice of one of these two...

| stats count by mygroup
| chart count by mygroup

stats presents one record per value of mygroup, chart would present them horizontally.

... OR ...

your query here 
| stats count(eval(Val_value>=0 AND Val_value<=3)) as "0.0 to 3.0",
    count(eval(Val_value>3 AND Val_value<=4)) as "3.0+ to 4.0",
    count(eval(Val_value>4 AND Val_value<=5)) as "4.0+ to 5.0",
    count(eval(Val_value>5 AND Val_value<=6)) as "5.0+ to 6.0",
    count(eval(Val_value>6)) as "6.+"

This second version presents them horizontally. If you wanted to change them to vertically, you could do it the other way, or add this afterward...

 | eval junk=1
 | untable junk mygroup count
 | fields - junk

View solution in original post

JyotiP
Path Finder

@DalJeanis can create a pi chart or graph for the above query ??

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

There are two basic syntaxes you can use (probably a dozen more, but these two demonstrate the top two in use)

your query here 
| eval mygroup=case(Val_value>=0 AND Val_value<=3,"0.0 to 3.0", 
    Val_value>3 AND Val_value<=4,"3.0+ to 4.0", 
    Val_value>4 AND Val_value<=5,"4.0+ to 5.0", 
    Val_value>5 AND Val_value<=6,"5.0+ to 6.0", 
    true(),"6.0+")

...then your choice of one of these two...

| stats count by mygroup
| chart count by mygroup

stats presents one record per value of mygroup, chart would present them horizontally.

... OR ...

your query here 
| stats count(eval(Val_value>=0 AND Val_value<=3)) as "0.0 to 3.0",
    count(eval(Val_value>3 AND Val_value<=4)) as "3.0+ to 4.0",
    count(eval(Val_value>4 AND Val_value<=5)) as "4.0+ to 5.0",
    count(eval(Val_value>5 AND Val_value<=6)) as "5.0+ to 6.0",
    count(eval(Val_value>6)) as "6.+"

This second version presents them horizontally. If you wanted to change them to vertically, you could do it the other way, or add this afterward...

 | eval junk=1
 | untable junk mygroup count
 | fields - junk

JyotiP
Path Finder

@DalJeanis, thanks for the update, let me try and will post my result

JyotiP
Path Finder

Currently I have separate query as follows :
query 1 : where Val_value>=0 AND Val_value<=3 | stats count
query 2 : where Val_value>=3.1 AND Val_value<=4 | stats count
query 3 : where Val_value>=4.1 AND Val_value<=5 | stats count
query 4 : where Val_value>=5.1 AND Val_value<=6 | stats count
So I want to merge the above request into 1 query. How to do it ?

0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW! Every day the list of sources Admins are responsible for gets bigger and bigger, often making ...