topic Re: How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing? in Splunk Search

How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing?

Hussain — Tue, 14 Jun 2022 16:31:19 GMT

How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing?

Log lines are like these:

2022/06/14 09:19:02 queue=ABC size=0 consumerCount=2 enqueueCount=12907 dequeueCount=15466

2022/06/14 08:19:02 queue=ABC size=0 consumerCount=2 enqueueCount=12850 dequeueCount=15409

looking to do subtraction of dequeueCount (15466-15409) and setup an alert if it equals to 0

Thanks

Re: Activemq dequeue count monitoring

ITWhisperer — Tue, 14 Jun 2022 09:29:26 GMT

Try something like this

| sort 0 _time | streamstats window=1 current=f values(dequeueCount) as previousDequeueCount | eval dequeues=dequeueCount-previousDequeueCount

Re: How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing?

Hussain — Wed, 15 Jun 2022 15:00:50 GMT

@ITWhisperer Thanks, tried but don't see any difference

streamstats looks better option, not sure how can we save max and min values as variable and and then do subtraction

Tried following (it is always giving latest result), was expecting output only when queue is not dequeuing for last an hour

sourcetype=amq_queues queue=ABC | where size > 0 | streamstats max(dequeueCount) as maximum min(dequeueCount) as minimum | where maximum - minimum = 0

Re: How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing?

somesoni2 — Wed, 15 Jun 2022 15:12:04 GMT

Try something like this

sourcetype=amq_queues queue=ABC | where size > 0 | eventstats max(dequeueCount) as maximum min(dequeueCount) as minimum by queue | where maximum=minimum

Re: How can we subtract dequeue count of now with an hour before dequeue count number to monitor queues are progressing?

ITWhisperer — Wed, 15 Jun 2022 15:19:04 GMT

Please can you expand on your problem - do you have multiple log events per hour? do you want to compare the first event with the last event? do you want only one result?