index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name
how can i add logic for $spantime$ to take values based on itemkey value
case itemKey = "x" then 10
case itemKey = "y" then 1 ?
thanks for the response i tried both methods but could not see change in span value 😞
index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="ms.db.cpu_usage_percent*",1,itemKey=="ms.db.connection_count",10)."m" | return $spantime ] SUM(value) by name
whats the literal search look like in the job inspector?
index=xxx sourcetype="xxx" itemKey ="$metric$" name = "$Host$" | timechart span=$spantime$m $statistic$(value) by name
based on value selected by user in itemKey we need to set the spantime for time chart
Hi vinay4444, I believe something like this will work, referencing the documentation on case : http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions#Comparison_and...
index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | timechart [ eval spantime="span=".case(itemKey=="x",10,itemKey=="y",1)."m" | return $spantime ] $statistic$(value) by name
Guessing you are spanning in minutes, so concatenated an m to the end, but you could modify that or build it into the case statement.
Let me know how this works!
I'm not sure the timechart command will work with variable substitution, but if it does it will be something like this.
index=XXX sourcetype="XXX" itemKey ="$metric$" name = "$Host$" | eval spantime=case(itemKey="x",10, itemKey="y",1, 1=1,1) | timechart span=$spantime$m $statistic$(value) by name