topic Splunk alret in Splunk Search

Splunk alret

saidAb — Mon, 29 Apr 2024 11:46:23 GMT

Hello everyone,

I am looking for a Splunk search query to get the duration time of three sequential response code 200. It is not about average time or duration of one message but if three Success message responses taken totally more than 10 seconds.

Thanks in advance.

Re: Splunk alret

ITWhisperer — Mon, 29 Apr 2024 11:58:13 GMT

Try something like this

| eval successtime=if(status=200,_time,null()) | streamstats range(successtime) as successrange count(successtime) as successcount window=3 by status global=f | where successcount=3 and successrange > 10

Re: Splunk alret

saidAb — Mon, 29 Apr 2024 12:07:18 GMT

I mean three consecutive respaces 2000.

Re: Splunk alret

ITWhisperer — Mon, 29 Apr 2024 12:41:54 GMT

Did you mean that the response codes are all 200 but take more than 10 seconds?

If so, what do you want to do if there are non-200 responses?

Please clarify your requirement

Re: Splunk alret

saidAb — Mon, 29 Apr 2024 12:58:29 GMT

I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this.

Re: Splunk alret

saidAb — Mon, 29 Apr 2024 13:02:04 GMT

Thanks! This query gives some answer. However, I still have to find the one with this situation:
I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this. So the query should result only this three consecutive 200 responses that together take more that 10 seconds.

Re: Splunk alret

ITWhisperer — Mon, 29 Apr 2024 13:02:55 GMT

This is what my solution does - how does it not do what you expect? Please provide examples

Re: Splunk alret

saidAb — Mon, 29 Apr 2024 15:20:08 GMT

At this moment, all message responses come in less that 10 seconds. This okay.

We want to create an alert, that if eg, next happens:

Time message repose code

15:00:43 200

15:00:45 200

15:00:54 200

Time message repose code

15:00:43 200

15:00:55 200

15:00:56 200

So if 3 responses code 200 come with no error response between, and totally, they take more than 10 seconds.

Re: Splunk alret

ITWhisperer — Mon, 29 Apr 2024 22:20:13 GMT

Try it this way

| eval successtime=if(status=200,_time,null()) | streamstats range(successtime) as successrange count(successtime) as successcount window=3 by status reset_on_change=t | where successcount=3 and successrange > 10

Re: Splunk alret

saidAb — Tue, 30 Apr 2024 12:24:26 GMT

This gives almost the same result, time of succses events. This is useful for the future. For now I wait with this query, because it seems we need a field 'Duration' in message to check the performances of response call