Splunk Search

sum values if<

HeinzWaescher
Motivator

Hi,

I'm calculating a duration for each event in the dataset and would like to calculate the sum for all durations < 43200000

stats sum(eval(if(Duration_ms<43200000, Duration_ms,0))) AS total_duration

I made some tests and it the results seem to fit approximately, but I don't feel conifdent whether this is the correct approach. Am I doing it right? Do i need some quotes somewhere in the if-command?

Is it also possible to have " > AND < " condition here? So to sum all durations >0 AND <43200000.

Thanks

Heinz

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

that works fine

stats sum(eval(if((Duration_ms > 0 AND Duration_ms<43200000), Duration_ms,0))) AS Total_Duration

or to make it more readable, if it fits your use case, you can make the conditions part of the search terms;

sourcetype = blah Duration_ms > 0 Duration_ms < 43200000 | stats sum(Duration_ms) as Total_Duration

/K

View solution in original post

kristian_kolb
Ultra Champion

that works fine

stats sum(eval(if((Duration_ms > 0 AND Duration_ms<43200000), Duration_ms,0))) AS Total_Duration

or to make it more readable, if it fits your use case, you can make the conditions part of the search terms;

sourcetype = blah Duration_ms > 0 Duration_ms < 43200000 | stats sum(Duration_ms) as Total_Duration

/K

HeinzWaescher
Motivator

Hi Kristian,

the second option doesn't fit, because i need these filtered events for other stats in this search.

Thanks a lot for confirming and adding the AND function!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...