Splunk Search

Is it possible for the chart command to not get executed unless cix is equal to the number 1?

bdh5574
New Member

I have the following search. What I would like is for the chart command to not get executed unless cix is equal to the number 1.
Is that possible? To have a conditional calculation?

| rename SMF70DTE as Date, SMF70TME as Time, SMF70SID as LPAR 
| eval IntervalTime=strftime(_time,"%H.%M")
| rex "SMF70CIX_\d{4}\":\"(?P<cix>[0-9.]+)\"" 
| rex "SMF70PDT_\d{4}\":\"(?P<pdt>[0-9.]+)\"" 
| chart sum(pdt) over IntervalTime by LPAR

Thanks, Bob

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

After rex number 1 and before chart, insert this line

| search cix=1 

It doesn't really matter if it's before or after rex number 2, but before rex number 2 is slightly more efficient.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...