Need help on Queries Combination.

jackin — Mon, 20 Dec 2021 04:20:39 GMT

Hi,
Search 1: It is used to findout the server health
index=win sourcetype="xmlwineventlog" host=Prod_UI_*
| eval Status=if(EventCode=41 OR EventCode=6006 OR EventCode=6008,"Down","Up")
| dedup host
| table Status

Search 2 : It is used to findout the CPU Usage

Search 3 : It is used to findout the Memory Usage

| mstats avg(_value) prestats=true WHERE metric_name="Memory.%_Committed_Bytes_In_Use" AND
"index"="winperf" AND
host=Prod_UI_* span=60s
| eval Timestamp=strftime(_time ,"%d/%m/%Y %H:%M:%S")
| stats avg(_value) AS Memory BY host Timestamp
| where Memory>=0
| eval Status="Critical",Memory=round(Memory,2),Memory=Memory+"%"
| rename host as Hostname
| table Timestamp Hostname Memory Status
| dedup Hostname
| sort - Memory

finally I need a query to know the server health and CPU and memory usage in single table.
and if CPU used >75% or memory used >75% it should show that the server is Down.

Hostname Health CPU Memory
Google Down 76% 45%

Re: Need help on Queries Combination.

PickleRick — Mon, 20 Dec 2021 07:32:11 GMT

I've never had the opportunity to work with metric indexes but my intuition tells me to try append or multisearch and do stats on the resulting data.

But there are some other things about your searches.

Firstly - in order to combine your results, you have to correlate them on time, right? So you heed to bin the results from your first search by time.

Secondly, use fieldformat on _time field, not eval for rendering it as string. If you use string timestamp representation, you will sort this field lexicographicaly which is almost never what you want.

Thirdly, "| dedup Hostname" might lose data. It will deduplicate events basing on hostname field ignoring whether other fields differ or not. Are you sure that's what you want?

topic Re: Need help on Queries Combination. in Splunk Search

Need help on Queries Combination.

Re: Need help on Queries Combination.