I'm trying to write a search that will look at performance logs for my servers, putting the data from one set of servers into one bin, and everything else into a second bin.
Here's my attempt:
index=myindex sourcetype=performance_file ExecutionTime | eval category=(host="host1" OR host="host2" OR host="host3" OR host="host4", "SpecialServers", host!="host1" AND host!="host2" AND host!="host3" AND host!="host4", "OtherServers") | timechart span=1m avg(resptime) by category
I'm surprised by the error I'm getting:
Error in 'eval' command: The expression is malformed. Expected ).
Am I on the right track at all? I'm a bit of a rookie at advanced queries like this.
Try This
index=myindex sourcetype=performance_file ExecutionTime | eval category=if(host="host1" OR host="host2" OR host="host3" OR host="host4", "SpecialServers", "OtherServers") | timechart span=1m avg(resptime) by category
You were on the right track but I just modified your eval to use an if statement.
Here is the link with the syntax for if statements and many others.
http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions
You forgot the "case" and the double =
eval category = case(host ...
take a look at example 11 here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
No need for a case if he just wants 2 groups of items. If he wanted 3 or more then a case statement would work better than an if statement.
True. I didn't notice there were just two groups. Just saw a long eval and "assumed" there were more.
Yup I did the same thing until I read through his query 🙂 All good.
Try This
index=myindex sourcetype=performance_file ExecutionTime | eval category=if(host="host1" OR host="host2" OR host="host3" OR host="host4", "SpecialServers", "OtherServers") | timechart span=1m avg(resptime) by category
You were on the right track but I just modified your eval to use an if statement.
Here is the link with the syntax for if statements and many others.
http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions