Splunk Search

help on where clause

jip31
Builder

hi

why my where condition doesnt works please?

 

`boot` 
| fields host Name Path DegradationTime 
| stats max(DegradationTime) as DegradationTime by Path 
| where DegradationTime>1
| eval "DegradationTime" = round(('DegradationTime' / 1000),0) 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust
Yes..
I tried this..

| makeresults
| eval DegradationTime="100000" ,Path="C:"
| stats max(DegradationTime) as "DegradationTime" by Path
| eval "DegradationTime" = round(('DegradationTime' / 1000),0)
| where DegradationTime>1
| rename DegradationTime as "Degradation time (seconds)"

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31 

Can you please share sample OP from this? 

| fields host Name Path DegradationTime 
| stats max(DegradationTime) as DegradationTime by Path 
0 Karma

jip31
Builder
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
It looks you rename DegradationTime field.. Did you tried where condition before rename?? It's working for me.
0 Karma

jip31
Builder

I dont understand

something like this??

 

| stats  max(DegradationTime) as "DegradationTime" by Path 
| eval "DegradationTime" = round(('DegradationTime' / 1000),0) 
| where DegradationTime>1 
| rename DegradationTime as "Degradation time (seconds)" 
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
Yes..
I tried this..

| makeresults
| eval DegradationTime="100000" ,Path="C:"
| stats max(DegradationTime) as "DegradationTime" by Path
| eval "DegradationTime" = round(('DegradationTime' / 1000),0)
| where DegradationTime>1
| rename DegradationTime as "Degradation time (seconds)"

View solution in original post

0 Karma

jip31
Builder

yes it works now thanks

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!