Hi guys, I'm new to splunk and I have one issue with filtering my search results based on a case condition
My search string:
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20
I now I need to filter this based on the field named host=selected_host
It doesn't sound very complex but I cannot make it work.
Thank you,
Andrei
Try one of these.
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | where host=selected_host | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20
sourcetype="WMI:CPUTime" | where host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20
May I know how you are setting $ddl_instance$ token?
It is most likely that eval can be used to set token at the same place for host directly. That way you will be able to add host in your base query hence resulting in filtering required results upfront rather than later. This should improve your search performance. (http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting)
In the current query you can change by host to by selected_host
in your timechart command
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by selected_host limit=20
Try one of these.
sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | where host=selected_host | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20
sourcetype="WMI:CPUTime" | where host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20
Thanks a lot! Tried the first query and it worked!