topic Re: eventtypes identification in Splunk Search

eventtypes identification

rakesh_498115 — Mon, 04 Jun 2012 10:18:17 GMT

I have created 21 eventypes for my requirement.In tat 21 eventypes when i write a query only few eventtypes are involved . how do we indentify those eventtypes ?? and after identifying the eventtypes i need to print a table which shows the time duration taken for each eventype.

for Example assuse I have 21 eventtypes with names A,B,C,D...U .My requirement is i need to pass a searchparameter to a searchquery , which on excuting only involves few eventypes ..i need to indentify them and print the dimension duration spent for each eventype.assue A,B and D are the eventtypes involved for my searchquery with the given searchparameter value..

Now i need the table like this.

SearchParameter A B D

AAA 34 45 45

where A,B,D are the involved eventypes for the searchquery with searchparameter "AAA" and 34,45,45 are the duration time in secs spent at eventtype..Please reply asap.Thnx in advance..

Re: eventtypes identification

lguinn2 — Mon, 04 Jun 2012 20:06:49 GMT

Here is a possible starting point, updated based on first comment:

yoursearchhere |
eval etype = case(eventtype=="eventtype1","eventtype1",eventtype="eventtype2","eventtype2") |
stats count by etype

This creates a new field called etype, which is set to one of the applicable eventtypes. This will work great, if you are only interested in a few of the eventtypes, and if the eventtypes do not overlap.

However, this does not calculate a "duration." You didn't give enough information for me to suggest how to do that.

I would suggest that you work this through with a particular search parameter, and when you are happy with the output - save the search as a macro. As a macro, you could do the parameter substitution that I think you ultimately want.

Re: eventtypes identification

rakesh_498115 — Tue, 05 Jun 2012 09:09:36 GMT

i have used this . but then its displaying all the eventtypes .but i need only specfic eventtypes to display..ie the eventtypes which are involved for that particular search query