topic Re: Multiple Stats from Base Search in Splunk Search

Multiple Stats from Base Search

cdstealer — Thu, 08 Oct 2020 07:02:13 GMT

Hi, I'm trying to populate a dashboard using a base search and then pulling multiple stats from those results.

base search:

index=production sourcetype="audit" environ::LV

inline search:

| appendpipe [ stats count AS Total by _time] | appendpipe [ search ("Error:" OR auditType="error") | stats count AS error by _time] | appendpipe [ where auditMicroSeconds>3 | stats count AS Over BY _time] | appendpipe [ search ("data retrieval" AND "failed") | stats count AS failed BY _time] | timechart span=30s count(Total) AS Total count(error) AS Error count(Over) AS Over

But it just doesn't work. Hope this makes sense.

TIA

Steve

Re: Multiple Stats from Base Search

ITWhisperer — Wed, 07 Oct 2020 16:38:22 GMT

Would something like this get you what you want?

index=production sourcetype="audit" environ::LV | eval error=if(searchmatch ("Error:" OR auditType="error"),1,null()) | eval Over=if(auditMicroSeconds>3,1,null()) | eval failed=if(searchmatch ("data retrieval" AND "failed"),1,null()) | timechart span=30s count AS Total count(error) AS Error count(Over) AS Over

Re: Multiple Stats from Base Search

cdstealer — Thu, 08 Oct 2020 05:39:04 GMT

Hey, Thanks for the suggestion 🙂 Unfortunately it doesn't work 😞 I had to remove the OR X and AND X from the searchmatch and then it just returned the same results as the original. Appreciated though.

Re: Multiple Stats from Base Search

cdstealer — Thu, 08 Oct 2020 11:03:58 GMT

Solving my own question 🙂

Base search is now:

index=production sourcetype="audit" environ::LV | table *

and panel searches are:

| search (field=value OR field=value OR field=value) field=value | appendpipe [stats count AS total by _time] | appendpipe [search auditType="error" | stats count AS error by _time] | appendpipe [where auditMicroSeconds>3 | stats count AS over BY _time] | appendpipe [search ("data retrieval" AND "failed") | stats count AS failed BY _time] | timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total

Data is now being presented as expected 🙂