topic Re: Count the number of api occurrence in 10 second in Splunk Search

Count the number of api occurrence in 10 second

JyotiP — Fri, 27 Sep 2019 08:40:02 GMT

I have the following API's, for which I need to count the occurrence of each in every 10 seconds for 1 hour time interval.

/api/login/v1/session
/api/data/v1/graphql
/api/order/v1/orders
/api/order/v1/states
/api/order/orderimporter/v1/importcsv
/api/order/orderimporter/v1/promote
/api/order/orderimporter/v1/stagingOrder
/api/order/v3/graphql
/api/order/desk/v2/quickSend
/api/order/v1/desk/Batch/sync
/api/order/v1/Orders/sync

I tried with

host=*localhost* Path=*** sourcetype=nginx 
| where Path in ("/api/platform/v1/session" OR "/api/coredata/v1/graphql" OR "/api/trading/v1/orders")
| table Path

But getting Error in 'where' command: Typechecking failed. 'OR' only takes boolean arguments

Basically I want the count of all the listed api in every 10 seconds for 1-hour interval.

Re: Count the number of api occurrence in 10 second

techiesid — Fri, 27 Sep 2019 08:46:01 GMT

It should be smething like below,

host=*localhost* Path=*** sourcetype=nginx 
 | search Path IN  ("/api/platform/v1/session" ,"/api/coredata/v1/graphql" , "/api/trading/v1/orders")
 | table Path
| timechart count span=10s

Sid

Re: Count the number of api occurrence in 10 second

JyotiP — Fri, 27 Sep 2019 09:13:43 GMT

@techiesid this work fine without timechart count span=10s, when I use this no result is coming

Re: Count the number of api occurrence in 10 second

kmorris_splunk — Fri, 27 Sep 2019 12:36:44 GMT

Here is an example from some different data:

sourcetype=access_combined earliest=-60m
| bin _time span=10s
| timechart count by action

You might consider using Trellis visualization as well, which automatically creates a different line graph for each.