Splunk Search

Reason field using multiple criteria

codedtech
Path Finder

Hello all,  I trying to get a reason field to generate based on field values as to why a system is showing up in a report.  This is the example of the where clause I'm using, that defines what I'm looking for.

| where
((system_class="Echo") AND ('Mem_Util'>=83 OR 'CPU_Util'>=83 OR 'Mem_Al'>=100 OR 'CPU_Al'>=110))

For example if I Mem_Util is the reason it shows up on the report,  I want a reason field to display at the end of the output that says Memory Util.  What makes it more interesting is that I have 5 different system_classes  with 5 different levels of of values for each of the 4 metrics.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It might be the size of the case/eval. You could split it into parts and re-evaluate the parts

 

| eval reason_echo=if(system_class="Echo", case('Mem_Util'>=83 "Mem_util", 'CPU_Util'>=83, "CPU_Util", 'Mem_Al'>=100, "Mem_Al" ..., 1=1, NULL()), NULL())
| eval reason_class2=if(system_class="Class2", case('Mem_Util'>=83 "Mem_util", 'CPU_Util'>=83, "CPU_Util", 'Mem_Al'>=100, "Mem_Al" ..., 1=1, NULL()), NULL())
...
| eval reason=coalesce(reason_echo, reason_class2,...

 

So, if the if condition is false, or case does not find a match, the value is set to NULL() so coalesce will move on to the next reason code

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You could have a large case statement

| eval reason=case((system_class="Echo" AND 'Mem_Util'>=83), "Mem_util", (system_class="Echo" AND 'CPU_Util'>=83 ), "CPU_Util", (system_class="Echo" AND 'Mem_Al'>=100), "Mem_Al" ...
0 Karma

codedtech
Path Finder

I can get one group values fine, but when I add another set of values, the eval command gets malformed.  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It might be the size of the case/eval. You could split it into parts and re-evaluate the parts

 

| eval reason_echo=if(system_class="Echo", case('Mem_Util'>=83 "Mem_util", 'CPU_Util'>=83, "CPU_Util", 'Mem_Al'>=100, "Mem_Al" ..., 1=1, NULL()), NULL())
| eval reason_class2=if(system_class="Class2", case('Mem_Util'>=83 "Mem_util", 'CPU_Util'>=83, "CPU_Util", 'Mem_Al'>=100, "Mem_Al" ..., 1=1, NULL()), NULL())
...
| eval reason=coalesce(reason_echo, reason_class2,...

 

So, if the if condition is false, or case does not find a match, the value is set to NULL() so coalesce will move on to the next reason code

Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...