topic Re: span 5min for the last 15min in Splunk Search

span 5min for the last 15min

LauraBre — Mon, 28 Sep 2020 12:09:16 GMT

Hello,

I have this following search:

I want to calculate the "TAUX" for the last 15 min but I want to have a result with a span of 5 min and launch an alert if there are more than 2 results. That means that the TAUX equals 100 twice during the last 15 minutes. How can I apply this span of 5min in my search?

Thanks by advance,

Laura

Re: span 5min for the last 15min

MHibbin — Thu, 26 Jul 2012 16:11:07 GMT

Perhaps this would help you, for the span/bucket...

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/bucket

And then put "earliest=-15m latest=0" in you orginal search command (i.e. source="Laura_ACS")

And then perhaps use streamstats, instead of stats, to prevent it from formatting results in to a table and keep all raw fields/data,

You can then use transaction to group events as required, and alert when you have 2 complete transactions

Regards,

MHibbin

Re: span 5min for the last 15min

MHibbin — Thu, 26 Jul 2012 16:17:22 GMT

I haven't tested this, as I don't have any data available at the moment that I can test this on... its more of some suggestions on points to look at, that have helped me in similar situations.

Re: span 5min for the last 15min

LauraBre — Thu, 26 Jul 2012 17:47:55 GMT

Thx very much. I test this tomorrow and I return my search as soon as I have good results.

Re: span 5min for the last 15min

LauraBre — Fri, 27 Jul 2012 08:28:55 GMT

Hello,

I test this but I have a problem because I have to apply the span on all my search :
-eventstats count as "totalVE"
-eventstats count(eval(STAT_VE="N")) as "totalVENO"
-stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX

But I don't know how can do it.

Thanks by advance,

Laura

Re: span 5min for the last 15min

MHibbin — Fri, 27 Jul 2012 11:18:45 GMT

I'm sorry I don't understand this question ... 😞

Re: span 5min for the last 15min

LauraBre — Fri, 27 Jul 2012 12:13:00 GMT

transaction is an answer but I don't know how can I apply this on my search because I have several subsearches. I want to calculate the taux for all the range time.

Thx by advance,

Laura