Splunk Search

chart sum eval if not working....

KarunK
Contributor

Hi,

I have the following search string which works

(sourcetype="cds_fms_access" x_event="*connect" x_status="200") | chart sum(bytes) as sum by hostname, x_event 

And will give a results like this

hostname       connect        disconnect
--------       -------        ----------
host1           1000          2000
host2           500           1500

I need to add one more field to chart eventype. something like this, which wont work.

  (sourcetype="cds_fms_access" x_event="*connect" x_status="200") | chart sum(bytes) as sum by hostname, x_event , eventtype

What I am trying to do is calculate the bytes if x_event=connect and disconnect separately by hostname and eventtype.

I have tried to use sum(eval(if(x_event="disconnect",0))) but i have got an error

""Error in 'chart' command: The eval expression for dynamic field 'if(x_event="disconnect",0)' is invalid. Error='The arguments to the 'if' function are invalid.'"

Please Help.

Thanks in Advance

Tags (2)
0 Karma

Drainy
Champion

As per the docs;
http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions

The IF statement requires three inputs, the test, IF true and a final value for IF not true (the else)

An example from the docs for quick reference;

err=if(error == 200, "OK", "Error")
0 Karma

MarioM
Motivator

I am not sure "if" works with "chart" but it does with "stats" :
| stats sum(eval(if(eventtype=="SOME_EVENT,SOME_FIELD",0))) as SOME_TOTAL

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...