Splunk Search

eval query

geekygaurav
Observer

Hello All,

I'm displaying Failures and Delays of some processes running daily, i need to make a dashboard where i have to show the volatility of a process, like if the process is getting failed and delayed for the same execution date i should get volatilty value count as 1. Can anybody help me how to construct a eval query with some condition so if Delay count =1 and Failure count=1 for a particular execution date, the volatility count should come as 1. please help

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you looking for something like this?

| eval volatilityCount = if(DelayCount==1 AND FailureCount==1, 1, 0)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...