topic Re: multiple splunk search queries in Reporting

multiple splunk search queries

appusplunk14 — Mon, 28 Dec 2020 21:08:28 GMT

Team,

i would like to generate TPS based on two different search criteria but both has to run single report and should be populate both TPS values in single report.

Query 1:

index=abc "String 1"
| bin _time span=1s
| chart count as TPS by _time
| timechart max(TPS) as peakTPS eval(round(avg(TPS),2)) as avgTPS span=1h

Query 2:

index=abc "String1" OR "String 2"
| bin _time span=1s
| chart count as TPS by _time
| timechart max(TPS) as peakTPS eval(round(avg(TPS),2)) as avgTPS span=1h

Here query 1 finds TPS and Peak TPS based on one particular string and query 2 find TPS , Peak TPS based on string which i used on query 1 and another string on top of it. Now i would like to get merge both of then in single query so that one single report is enough for providing metrics

Re: multiple splunk search queries

to4kawa — Tue, 29 Dec 2020 00:33:40 GMT

sample:

Re: multiple splunk search queries

appusplunk14 — Tue, 29 Dec 2020 02:03:17 GMT

thank you , its working good but i would like to include peakTime for both different search criteria , how do i do that? and what exactly untable means ? why are we using untable in this requirement?

Re: multiple splunk search queries

to4kawa — Tue, 29 Dec 2020 02:26:04 GMT

@appusplunk14 What's peakTime?

untable is need for second timechart.

Re: multiple splunk search queries

appusplunk14 — Tue, 29 Dec 2020 15:40:59 GMT

consider if i see peak TPS at 08:00 AM MST then i would like to print time stamp for that duration.

Re: multiple splunk search queries

to4kawa — Tue, 29 Dec 2020 21:59:34 GMT

Your first query didn't give us such a number, did it?
I can't create something out of thin air.

Re: multiple splunk search queries

appusplunk14 — Thu, 31 Dec 2020 17:32:35 GMT

given query is displaying data like below:

2020-12-31 10:00 108.77 56.91 1835 143
2020-12-31 11:00 109.00 54.49 2167 119
2020-12-31 12:00 110.47 56.49 1823 131

as i said we want to display time during which we had high number of events in that hour.

Re: multiple splunk search queries

to4kawa — Thu, 31 Dec 2020 22:46:29 GMT