Alerting

How to return a row for each hour of the day when my alert is scheduled?

txc168
Explorer

Right now this is displaying what I want but how can I return a row for each hour of the day when my alert is scheduled?

index=records "ProcessRec: Total Recd" 
| eval fields=split(_raw,"|") 
| eval Machine=mvindex(fields,4) 
| stats count(eval(Machine="SERVER1")) AS "SERVER1"  count(eval(Machine="SERVER2")) AS "SERVER2"
| addtotals
| foreach "SERVER1", "SERVER2" 
     [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]
Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

View solution in original post

to4kawa
Ultra Champion

UPDATE:

 index=records "ProcessRec: Total Recd" 
 | eval fields=split(_raw,"|") 
 | eval Machine=mvindex(fields,4) 
 | timechart span=1h count by Machine
 | addcoltotals labelfield="_time"
 | addtotals
 | appendpipe [|tail 1
     |foreach SERVER* [| eval "<<FIELD>> %"=round((<<FIELD>>/Total)*100,2)]]
 | selfjoin _time keepsingle=1
 | reverse

As Alerting, send email with Include Inline

txc168
Explorer

Awesome that worked, but how do I keep my percentage count and total count? Need to know what percentage and total count the server is processing. This alert is sent to management they don't want to add.

0 Karma

to4kawa
Ultra Champion

I see, check my answer.

0 Karma

txc168
Explorer

Awesome i was able to get it to work only fix was changing |tail = 25. Might play around with it after i get a full 24h. Thank you so much for your help and suggestions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...