Setup
An app that shows how certain function of business is doing during an event. I've Splunk 6.2 dashboard to show about 4~6 panels showing different metrics including what we call as time between states ...
These are calculated as time between different states of an order.
Need
Assume there are five states create, queue , submit, assign, confirm.
One client might require to combine create + queue as one state , while other may require create and queue to be different states of an order..
Meaning, client 1 may consider queue time as assign_timestamp - min(create_timestamp, queue_timestamp) ...client 2 might consider queue time as (quue_timestamp - create_timestamp)
Question
If so How ?
Thanks, ronak
I've monkeyed around with having a lookup that maps groups to specific alert to thresholds - something like
alert1,group1,5
alert1,group2,4
alert1,group3,10
What you are proposing potentially could be done in a lookup but my mind slides more toward a complex case statement like
...| eval queue_time = case(group=client1, assign_timestamp - min(create_timestamp, queue_timestamp), group=client2, quue_timestamp - create_timestamp, 1=1, "fix me") | ..
Of course that doesn't really fit what you are looking for; conditions not being in the query or a macro. Of course if you have it in a macro it makes it much easier to update and keep track of /shrug.