case statement using token for span in timechart

[vinay4444]

index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name

how can i add logic for $spantime$ to take values based on itemkey value
case itemKey = "x" then 10
case itemKey = "y" then 1 ?

[vinay4444]

thanks for the response i tried both methods but could not see change in span value 😞

index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="ms.db.cpu_usage_percent*",1,itemKey=="ms.db.connection_count",10)."m" | return $spantime ] SUM(value) by name

[muebel]

whats the literal search look like in the job inspector?

[vinay4444]

index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name

[vinay4444]

based on value selected by user in itemKey we need to set the spantime for time chart

[muebel]

Hi vinay4444, I believe something like this will work, referencing the documentation on case : http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and...

index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="x",10,itemKey=="y",1)."m" | return $spantime ] $statistic$(value) by name

Guessing you are spanning in minutes, so concatenated an m to the end, but you could modify that or build it into the case statement.

Let me know how this works!

[richgalloway]

I'm not sure the timechart command will work with variable substitution, but if it does it will be something like this.

index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | eval spantime=case(itemKey="x",10, itemKey="y",1, 1=1,1) | timechart span=$spantime$m $statistic$(value) by name