topic Re: Filter condition in a timechart in Splunk Enterprise

Filter condition in a timechart

akpadhi — Fri, 05 Mar 2021 07:36:01 GMT

We have following query used for generating few dashboards. However we would like to setup an alert whenever the sum(connection_count) goes above a threshold value say 100. Tried few options but the filter contion is not working. Can someone please help.

index=app sourcetype=DBConnectionUsage NOT(application_user="No User" OR application_user="SYS" OR application_user="C##GGS_OWNER") | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3"| timechart span=1H sum(connection_count) by application_user

Re: Filter condition in a timechart

scelikok — Fri, 05 Mar 2021 07:42:46 GMT

You can try by naming the sum function like below;

index=app sourcetype=DBConnectionUsage NOT(application_user="No User" OR application_user="SYS" OR application_user="C##GGS_OWNER") | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3" | timechart span=1H sum(connection_count) as connection_count by application_user | where connection_count>100

Re: Filter condition in a timechart

ITWhisperer — Fri, 05 Mar 2021 07:58:02 GMT

By filter condition, are you referring to the custom condition on the alert, because there is a bug in some versions of splunk such that the custom condition does not work properly so doing the filtering in the search (as seen in @scelikok suggestion) is a reasonably workaround

Re: Filter condition in a timechart

akpadhi — Fri, 05 Mar 2021 08:08:50 GMT

@ITWhisperer @scelikok I tried above suggestion but the where condition is still not working and not returning any results even though the timechart values are satisfying the condition. Yes either a condition on the alert or in the search would work for me.

Re: Filter condition in a timechart

ITWhisperer — Fri, 05 Mar 2021 08:20:19 GMT

timechart doesn't return fields named sum(connection_count).

index=app sourcetype=DBConnectionUsage NOT(application_user="No User" OR application_user="SYS" OR application_user="C##GGS_OWNER") | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3" | bin span=1h _time | stats sum(connection_count) as connection_count by _time, application_user | where connection_count > 100

Re: Filter condition in a timechart

akpadhi — Fri, 05 Mar 2021 08:26:18 GMT

@ITWhisperer Thank you so much, this worked 🙂