topic Re: Splunk queries in Splunk Search

Splunk queries

saidAb — Tue, 30 Apr 2024 12:35:51 GMT

Hi all,

A query, can calculate http calls, success responses and error response. I need an addition to the query to get how many requests are without response. I mean calls - success_respnses - erros_rsponse = null_responses.

Some good idea bout this? Thanks in advance!

Re: Splunk queries

ITWhisperer — Tue, 30 Apr 2024 13:00:46 GMT

It depends on your data. Please can you share some sample anonymised represntative events in a code block so we can see what you are dealing with.

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 13:14:00 GMT

index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck

| fillnull value=0 backend_time

| stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error

E.g.

On the resuts, I see: Calls 27; Success 11; Error 6

I need also to see in the results, that there was no responses for 10 calls (null_resposes) as well.

Re: Splunk queries

ITWhisperer — Tue, 30 Apr 2024 13:25:35 GMT

index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck | fillnull value=0 backend_time | stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error | eval "No response"=Calls-Success-Error

Re: Splunk queries

gcusello — Tue, 30 Apr 2024 13:35:32 GMT

Hi @saidAb ,

if you could share your search, it's easier to help you, anyway, I suppose that you are using eval instats, in this case, add the total count of events and calcuate as difference from this value.

e.g.

<your_search> | stats count(eval(status="success")) success_count count(eval(status="failed")) failed_count count | eval others=count-success_count-failed_count

Ciao.

Giuseppe

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 13:55:51 GMT

Thanks!

This works partially very good. It provides in the results all calls, success, errors and no_responses (for the calls where no_response happens) . However it ignores other calls where requests and responses are equal.

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 14:15:54 GMT

Resolved. It works now correctly. I added 'by ...' and I see all the results.

Thank you very match!!!

Re: Splunk queries

gcusello — Tue, 30 Apr 2024 14:17:44 GMT

hi @saidAb ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 14:24:31 GMT

Gratie Giuseppe!

See you next time!

Have a nice day.

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 14:27:30 GMT

Thank you very match fro helping me!

This works now fine!

Have nice day!

Re: Splunk queries

saidAb — Tue, 30 Apr 2024 14:53:24 GMT

Super! Thanks!