topic How to create a Splunk search for the following problem? in Splunk Search

How to create a Splunk search for the following problem?

kc_prane — Mon, 07 Aug 2023 19:08:45 GMT

My base search PAGE_ID=*
| where PAGE_ID=DGEFH OR PAGE_ID =RGHJH NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY | eval sla= (countofpases/totalcount)*100 | table sla

I wanted to include all the PAGE_ID and the also use the criteria for the PAGE_ID=DGEFH and PAGE_ID =RGHJH

Re: Splunk search help!

richgalloway — Thu, 03 Aug 2023 18:50:46 GMT

The PAGE_ID field is not available to the table command because it was removed by the stats command. The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases. You could make PAGE_ID available by including it in the stats command.

PAGE_ID=* | where PAGE_ID=DGEFH OR PAGE_ID =RGHJH NOT NUM_OF_MONTHS_RUN>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID | eval sla= (countofpases/totalcount)*100 | table PAGEID sla

Re: Splunk search help!

kc_prane — Mon, 07 Aug 2023 18:01:19 GMT

Hi @richgalloway

Thanks for the response but i was looking for the results which gets PAGE_ID=* and the subsearch

"PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4"

Re: Splunk search help!

richgalloway — Mon, 07 Aug 2023 18:17:23 GMT

I explained why PAGE_ID are not in the results and offered one way to include it.

The original query already includes the specified search string (not a subsearch). How is it not meeting expectations?