topic Re: How to get peakstats and a count of success and errors for a month in one table? in Splunk Search

How to get peakstats and a count of success and errors for a month in one table?

ashidhingra — Tue, 23 Jan 2024 05:12:56 GMT

How to get peakstats and a count of success and errors for a month in one table?

Re: How to get peakstats and a count of success and errors for a month in one table?

gcusello — Tue, 23 Jan 2024 06:49:15 GMT

the search depends on the data you have.

So supponing that the field with the traffic to monitor i "bytes" and the field with access and failed is "action" and that you want thes monitoring for each host, you could try something like this, for a month:

<your_search> | stats max(bytes) AS peak count(eval(action="success")) AS success count(eval(action="failed")) AS failed BY host

Ciao.

Giuseppe

Re: How to get peakstats and a count of success and errors for a month in one table?

ashidhingra — Tue, 23 Jan 2024 07:38:58 GMT

I am getting the peak stats by bucket using this

<your_search> | bucket span=1s _time | stats count by _time | timechart max(count) AS Peak_TPS span=1m

Some how the two Queries are not working together

Re: How to get peakstats and a count of success and errors for a month in one table?

gcusello — Tue, 23 Jan 2024 07:51:44 GMT

Hi @ashidhingra,

yes, because after a stats command you have only the fields in the stats, you shuld try something like this:

<your_search> earliest=-1mon latest=@mon | bucket span=1s _time | stats count count(eval(action="success")) AS success count(eval(action="failed")) AS failed BY _time | stats max(count) AS Peak_TPS sum(success) AS success sum(failed) AS failed

You cannot use timechart because in timechart you cannot have more fields

Ciao.

Giuseppe