topic Re: Possible to achieve eval results per host? in Splunk Search

Possible to achieve eval results per host?

geek238 — Fri, 17 Feb 2012 20:49:08 GMT

Working with stat log events from DJB's dnscache. These look like:

@400000004f3ebb59244cc72c stats 275245265 10318311576 81 0

The first field is timestamp in tai64nlocal. Splunk deals with that. The first field after the 'stats' string is a query counter, constantly incrementing. To get querys/second for the DNS resolver, I can do:

index=dns earliest=-1m host=dns1 | rex field=_raw "stats\s(?<querycount>\d+) " | stats max(querycount) as hq,min(querycount) as lq | eval qps=(hq-lq)/60 | table host,qps,hq,lq

What I'd like to do is search against the index and execute stats and eval against values retrieved from each host observed in the index, without creating a separate search for each host. I've been thinking something along the lines of finding hosts in a subsearch then for each value returned, execute the search to gather statistics.

I'm sure someone has done something cool like this before.

Re: Possible to achieve eval results per host?

Ayn — Fri, 17 Feb 2012 21:39:16 GMT

You can use chart and then eval() stuff directly inside of it, so something like this should work:

index=dns earliest=-1m host=dns1 | rex field=_raw "stats\s(?<querycount>\d+) " | chart eval((max(querycount)-min(querycount))/60) as qps,max(querycount) as hq,min(querycount) as lq by host

Re: Possible to achieve eval results per host?

gkanapathy — Sat, 18 Feb 2012 00:09:50 GMT

index=dns earliest=-1m host=dns1 
| rex field=_raw "stats\s(?<querycount>\d+) " 
| stats max(querycount) as hq,
        min(querycount) as lq 
  by host
| eval qps=(hq-lq)/60

The "by" clause of the stats command does what you want.

Re: Possible to achieve eval results per host?

geek238 — Sat, 18 Feb 2012 01:32:58 GMT

Both answers work great, thanks!