Hi,
I use Splunk 6.2.
I try to compare two values between two differents weeks.
index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| eval r_before =
[search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]
| stats count AS r_now
But it doesn't work. I have the following error : "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])."
I use a script who extract the two values.
Can someone help me please ?
Thanks,
falcom92
I find the solution with append
and it works.
index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| stats count
| append [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]
Thanks.
I find the solution with append
and it works.
index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| stats count
| append [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]
Thanks.
Hi Falcom,
For ease of use I'd recommend the timewrap app, it adds an extra command/function to the search which lets you set a span, either by day, by week, by month for 1 search, which could help improve search speeds.
I second this or use stats
which will out-perform anything else - especially on long runs over a bigger time range.
Any kind of sub search such be your last resort not your first choice ....
Hi falcom92,
use the timewrap
app https://apps.splunk.com/app/1645 which will handle such things or take a look at this answer http://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html to get an idea how it can be done using some stats
commands.
Hope this helps ...
cheers, MuS