splunk eventstats related query

[alurisreedhar]

Hi,

I have a dataset like below:

Date             Rsource status 

10:00:00     A                Success

10:00:00     B                Success

10:00:01     A                Failure

10:00:02     A                Failure

10:00:02    C                Failure

10:00:02     B               Failure

10:00:02     A                Success

10:00:03     B                Success

10:00:03     A                Failure

10:00:04     A                Failure

10:00:04    C                Failure

10:00:04     B               Failure

I am working on metric where by if we have more than n number of consecutive errors in 30s then those need to be recorded. output in formart like below:

lets say in the above example we need it for more than 2 consecutive errors it should look something like this

Min_Time Max_time resource status count

10:00:01 10:00:02  A    2

10:00:03 10:00:04  A    2

I am trying to use combination of streamstats/eventstats nothing seems working.

any help would be much appreciated.

one of the examples I tried below

mysearch
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true|table start,end,start,resource,numberofstatus |streamstats first(start) as f_start last(end) as l_end max(numberofstatus) AS max_numberofstatus by code reset_on_change=true| table f_start,l_end,max_numberofstatus,code,resource

[richgalloway]

Part of the problem is inconsistent use of field names in the query.  There's 'resource' and 'resource_id' then "code" appears out of nowhere.  Splunk can't produce results from fields that don't exist.

See if this run-anywhere query helps.

|makeresults | eval _raw="Date     Rsource status 
10:00:00 A Success
10:00:00 B Success
10:00:01 A Failure
10:00:02 A Failure
10:00:02 C Failure
10:00:02 B Failure
10:00:02 A Success
10:00:03 B Success
10:00:03 A Failure
10:00:04 A Failure
10:00:04 C Failure
10:00:04 B Failure" | multikv forceheader=1 | eval _time=strptime(Date, "%H:%M:%S") | sort _time | rename Rsource as resource_id
```Above just sets up test data```
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true
| fields start,end,start,resource_id,numberofstatus,status
| where status="Failure" and numberofstatus>1