Alerting

splunk eventstats related query

alurisreedhar
Loves-to-Learn

Hi,

I have a dataset like below:

Date             Rsource status 

10:00:00     A                Success

10:00:00     B                Success

10:00:01     A                Failure

10:00:02     A                Failure

10:00:02    C                Failure

10:00:02     B               Failure

10:00:02     A                Success

10:00:03     B                Success

10:00:03     A                Failure

10:00:04     A                Failure

10:00:04    C                Failure

10:00:04     B               Failure

I am working on metric where by if we have more than n number of consecutive errors in 30s then those need to be recorded. output in formart like below:

lets say in the above example we need it for more than 2 consecutive errors it should look something like this

Min_Time Max_time resource status count

10:00:01 10:00:02  A    2

10:00:03 10:00:04  A    2

I am trying to use combination of streamstats/eventstats nothing seems working.

any help would be much appreciated.

one of the examples I tried below

mysearch
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true|table start,end,start,resource,numberofstatus |streamstats first(start) as f_start last(end) as l_end max(numberofstatus) AS max_numberofstatus by code reset_on_change=true| table f_start,l_end,max_numberofstatus,code,resource

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Part of the problem is inconsistent use of field names in the query.  There's 'resource' and 'resource_id' then "code" appears out of nowhere.  Splunk can't produce results from fields that don't exist.

See if this run-anywhere query helps.

|makeresults | eval _raw="Date     Rsource status 
10:00:00 A Success
10:00:00 B Success
10:00:01 A Failure
10:00:02 A Failure
10:00:02 C Failure
10:00:02 B Failure
10:00:02 A Success
10:00:03 B Success
10:00:03 A Failure
10:00:04 A Failure
10:00:04 C Failure
10:00:04 B Failure" | multikv forceheader=1 | eval _time=strptime(Date, "%H:%M:%S") | sort _time | rename Rsource as resource_id
```Above just sets up test data```
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true
| fields start,end,start,resource_id,numberofstatus,status
| where status="Failure" and numberofstatus>1

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...