Splunk Search

How to seperate status based on response time values ?

karthi2809
Contributor

I need only amber and severe but i am not getting any result

base search|eval responseTime=TransactionEndtime-TransactionStartTime|eval responseTime=round((responseTime/1000),3)| stats avg(responseTime) as "avgResponseTime" by Category,Verb|eval respTimeStatus=if(avgResponseTime>15,"25",(if(avgResponseTime>=7 AND avgResponseTime<=15,"15","5"))) |rangemap field=respTimeStatus Low=0-10 Amber=11-20 Severe=21-30|stats values(range) as Status values(avgResponseTime) as avgResponseTime by Category,Verb|Where (Status="Amber" OR Status="Severe")

Tags (2)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this - implemented @somesoni2's suggestions, removed the redundant second test against 15, which must always be true, removed the redundant final stats command in favor of just renaming the range field, also set final | where to lower case.

base search
    | eval responseTime=TransactionEndtime-TransactionStartTime
    | eval responseTime=round((responseTime/1000),3)
    | stats avg(responseTime) as "avgResponseTime" by Category,Verb
    | eval respTimeStatus=case(avgResponseTime>15,25, avgResponseTime>=7,15, true(),5 ) 
    | rangemap field=respTimeStatus Low=0-10 Amber=11-20 Severe=21-30
    | rename range as Status
    | where (Status="Amber" OR Status="Severe")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rangemap command expects numeric values, but you have text values. Try removing the quotation marks from your if statement. Also, consider using case instead of nested ifs as it's easier to read.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...