Alerting

How to return a row for each hour of the day when my alert is scheduled?

txc168
Explorer

Right now this is displaying what I want but how can I return a row for each hour of the day when my alert is scheduled?

index=records "ProcessRec: Total Recd" 
| eval fields=split(_raw,"|") 
| eval Machine=mvindex(fields,4) 
| stats count(eval(Machine="SERVER1")) AS "SERVER1"  count(eval(Machine="SERVER2")) AS "SERVER2"
| addtotals
| foreach "SERVER1", "SERVER2" 
     [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]
Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

View solution in original post

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

txc168
Explorer

Awesome that worked, but how do I keep my percentage count and total count? Need to know what percentage and total count the server is processing. This alert is sent to management they don't want to add.

0 Karma

to4kawa
Ultra Champion

I see, check my answer.

0 Karma

txc168
Explorer

Awesome i was able to get it to work only fix was changing |tail = 25. Might play around with it after i get a full 24h. Thank you so much for your help and suggestions.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...