I am trying to convert the below Splunk query to Kusto.

| eval result=if(Match(Status,"Success|Passed"), "succeess","failed")

Below is the example from Kusto that is not clear . How do I modify this Kusto example as per the above Splunk Query pls. Thanks| extend day = iff(floor(Timestamp, 1d)==floor(now(), 1d), "today", "anotherday")

1 Answer

You could try this:

...
| summarize success = countif(Status in ("Success", "Passed")), total = count()
| project success, failure = total - success

• in case the values in the column named Status can have different casing, you can use in~()

• in case the values in the column named Status are longer strings, which you want to look for substring in, you can use, for example: Status contains "Success" or Status contains "Passed"

6

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy