Alerting

How to return a row for each hour of the day when my alert is scheduled?

txc168
Explorer

Right now this is displaying what I want but how can I return a row for each hour of the day when my alert is scheduled?

index=records "ProcessRec: Total Recd" 
| eval fields=split(_raw,"|") 
| eval Machine=mvindex(fields,4) 
| stats count(eval(Machine="SERVER1")) AS "SERVER1"  count(eval(Machine="SERVER2")) AS "SERVER2"
| addtotals
| foreach "SERVER1", "SERVER2" 
     [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]
0 Karma
1 Solution

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

View solution in original post

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

txc168
Explorer

Awesome that worked, but how do I keep my percentage count and total count? Need to know what percentage and total count the server is processing. This alert is sent to management they don't want to add.

0 Karma

to4kawa
Ultra Champion

I see, check my answer.

0 Karma

txc168
Explorer

Awesome i was able to get it to work only fix was changing |tail = 25. Might play around with it after i get a full 24h. Thank you so much for your help and suggestions.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...