Splunk Search

How to use a conditional variable in a stats count command?

Cuyose
Builder

Given the following search logic

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
| bin _time span=1d
| stats count as Total, count(eval(DurationTotal>$ActionSLA$) AS Latent by _time Action
| eval Percent=round(100-((Latent*100)/Total),2)

I want to have the $ActionSLA$ variable in the above pseudocode be different for each action so that I end up with results that look like the following where the Latent field is driven by the ActionSLA per Action. For instance Search ActionSLA=2000 when Action=Search, ActionSLA=4000 when Action=CreateOrder, etc.

_time              Action              Total    Latent  Percent
2017-01-26 09:00    Confirm           1259   864       31.37
2017-01-26 09:00    CreateOrder       611     147      75.94
2017-01-26 09:00    CreditRefund_Confirm 333      237      28.83
2017-01-26 09:00    FindItinerary       12461   2155      82.71
2017-01-26 09:00    Search             8349  3481     58.31
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
 | bin _time span=1d 
| eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0)
 | stats count as Total, sum(Latest) as Latent by _time Action
 | eval Percent=round(100-((Latent*100)/Total),2)

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.

index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) 
 | bin _time span=1d 
| eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0)
 | stats count as Total, sum(Latest) as Latent by _time Action
 | eval Percent=round(100-((Latent*100)/Total),2)
0 Karma

Cuyose
Builder

Ha, this is exactly what I was thinking of doing as well, but the syntax was throwing me. This did in fact work, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...