topic Re: ideas for reliably bracketing timerange around discrete 'snapshots' in Splunk Search

ideas for reliably bracketing timerange around discrete 'snapshots'

sideview — Thu, 14 Jul 2011 04:32:48 GMT

Say that you have a huge volume of events, and they come in big batches. Each batch is a discrete unit, and mixing information from the most recent batch with the previous batch is unacceptable.

more givens:

the events within a particular batch are spread out over a few minutes.
we do have control over the data so we could write a particular event at the start and at the end of the batch if necessary. We could even create a start/end event that had a different source or sourcetype.

Given all this, Is there a good clean way to construct a custom search or a custom view that will be sure to operate only on the events of the most recent batch?

Re: ideas for reliably bracketing timerange around discrete 'snapshots'

Stephen_Sorkin — Thu, 14 Jul 2011 12:50:40 GMT

Your best bet is to use the "head" command which can take a predicate instead of an absolute count.

For example, the following search only takes (all of) the events from the most recent second from index=_internal:

index=_internal | streamstats dc(_time) as dc_time | head dc_time==1

Re: ideas for reliably bracketing timerange around discrete 'snapshots'

sideview — Thu, 14 Jul 2011 17:19:58 GMT

The events here are not in a single second, but this offers a tool that seems to open up a number of other ideas. Is that ability of the head command new in 4.2? It seems like I could use eval and streamstats to keep track of when I see the 'start' event and 'end' event, and then use head to terminate once I get back to the correct head event. Is that what you would do?

Re: ideas for reliably bracketing timerange around discrete 'snapshots'

Brian_Osburn — Thu, 14 Jul 2011 17:27:09 GMT

Wouldn't this be a good use of a transaction command? especially if you've got a well defined start and stop?

Re: ideas for reliably bracketing timerange around discrete 'snapshots'

sideview — Thu, 14 Jul 2011 19:15:12 GMT

transaction wont work here because the set of events needs to be sliced and diced up a number of ways by a lot of different 'stats foo(bar) by baz, bat' searches, and transaction is going to put me in multivalue hell.

Re: ideas for reliably bracketing timerange around discrete 'snapshots'

Stephen_Sorkin — Sat, 16 Jul 2011 01:45:49 GMT

This ability of head has been around since 4.1, I believe.