Splunk Search

count(eval(execution-time)>1000) not working

VamshiBavu
Engager

when I run below query I am not able to get the sla_violation_count

index=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval(execution-time > SLA)) as sla_violation_count

total_calls are displaying as 1 but not able to get sla_violation_count

pasting the results below for the reference

{ 
   datacenter: aus
   env: qa
   execution-time: 2145
   thread: http-nio-8080-exec-2
   uri: v1/validatetoken
   uriTemplate: v1/validatetoken
}

 

Thanks in advance

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fieldname in single quotes

ndex=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval('execution-time' > SLA)) as sla_violation_count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try with the fieldname in single quotes

ndex=* execution-time=* uri="v1/validatetoken"  | stats count as total_calls, count(eval('execution-time' > SLA)) as sla_violation_count

VamshiBavu
Engager

@ITWhisperer thank you ,you made my day

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The stats(eval()) syntax can be confusing sometimes and is definitely underdocummented.

I don't like its implicit behaviour so I prefer doing stuff "the long way"

| eval is_sla_violated=if(execution-time > SLA,1,0)
| stats sum(is_sla_violated) as sla_violation_count

Of course instead of doing 1/0 and using sum you can do anything/null() and use count.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...