topic How to use eval with mstats in Splunk Search

How to use eval with mstats

nouraali — Fri, 27 Aug 2021 09:52:37 GMT

Hi,

I want to run something similar to the below on metrics data stored in metrics index, can you please assist:

eval ip34 = if(ip=="37.25.139.34",1,0) ,ip35 = if(ip=="37.25.139.35",1,0)
| mstats sum(ip34) , sum(ip35) ,
         avg(bytes) , stdev(bytes) , median(bytes) 
         avg(response_time_s) , stdev(response_time_s) , median(response_time_s) 
  where index=sfp_metrics earliest=-5m@m latest=@m span=1m by uri

It gives me:

Any idea how to achieve this would be appreciated.

Best Regards,

Re: How to use eval with mstats

venkatasri — Thu, 19 Aug 2021 02:36:00 GMT

Hi @nouraali

Never tried mstats your SPL need a change, try this

| mstats count(eval(ip=="37.25.139.34")) as ip34 , count(eval(ip=="37.25.139.35")) as ip35 , avg(bytes) , stdev(bytes) , median(bytes) avg(response_time_s) , stdev(response_time_s) , median(response_time_s) where index=sfp_metrics earliest=-5m@m latest=@m span=1m by uri | eventstats sum(ip34) as ip34, sum(ip35) as ip35 by uri | table ip* avg* std* med* uri

Re: How to use eval with mstats

nouraali — Thu, 19 Aug 2021 09:11:49 GMT

This gives me the below errors:

Re: How to use eval with mstats

venkatasri — Thu, 19 Aug 2021 11:44:53 GMT

| mstats seems doesn't support stats style eval aggr functions. How about changing to stats?

index=sfp_metrics earliest=-5m@m latest=now | bin span=1m _time | stats count(eval(ip=="37.25.139.34")) as ip34, count(eval(ip=="37.25.139.35")) as ip35,avg(bytes),stdev(bytes),median(bytes),avg(response_time_s),stdev(response_time_s),median(response_time_s) by _time, uri | eventstats sum(ip34) as ip34, sum(ip35) as ip35 by uri | table ip* avg* std* med* uri

Re: How to use eval with mstats

nouraali — Fri, 27 Aug 2021 09:51:21 GMT

This works only on events index, while the data i am searching is stored in metrics index.