Splunk Search

count(eval(execution-time)>1000) not working

VamshiBavu
Engager

when I run below query I am not able to get the sla_violation_count

index=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval(execution-time > SLA)) as sla_violation_count

total_calls are displaying as 1 but not able to get sla_violation_count

pasting the results below for the reference

{ 
   datacenter: aus
   env: qa
   execution-time: 2145
   thread: http-nio-8080-exec-2
   uri: v1/validatetoken
   uriTemplate: v1/validatetoken
}

 

Thanks in advance

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fieldname in single quotes

ndex=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval('execution-time' > SLA)) as sla_violation_count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fieldname in single quotes

ndex=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval('execution-time' > SLA)) as sla_violation_count

VamshiBavu
Engager

@ITWhisperer thank you ,you made my day

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The stats(eval()) syntax can be confusing sometimes and is definitely underdocummented.

I don't like its implicit behaviour so I prefer doing stuff "the long way"

| eval is_sla_violated=if(execution-time > SLA,1,0)
| stats sum(is_sla_violated) as sla_violation_count

Of course instead of doing 1/0 and using sum you can do anything/null() and use count.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...