Alerting

splunk eventstats related query

alurisreedhar
Loves-to-Learn

Hi,

I have a dataset like below:

Date             Rsource status 

10:00:00     A                Success

10:00:00     B                Success

10:00:01     A                Failure

10:00:02     A                Failure

10:00:02    C                Failure

10:00:02     B               Failure

10:00:02     A                Success

10:00:03     B                Success

10:00:03     A                Failure

10:00:04     A                Failure

10:00:04    C                Failure

10:00:04     B               Failure

I am working on metric where by if we have more than n number of consecutive errors in 30s then those need to be recorded. output in formart like below:

lets say in the above example we need it for more than 2 consecutive errors it should look something like this

Min_Time Max_time resource status count

10:00:01 10:00:02  A    2

10:00:03 10:00:04  A    2

I am trying to use combination of streamstats/eventstats nothing seems working.

any help would be much appreciated.

one of the examples I tried below

mysearch
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true|table start,end,start,resource,numberofstatus |streamstats first(start) as f_start last(end) as l_end max(numberofstatus) AS max_numberofstatus by code reset_on_change=true| table f_start,l_end,max_numberofstatus,code,resource

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Part of the problem is inconsistent use of field names in the query.  There's 'resource' and 'resource_id' then "code" appears out of nowhere.  Splunk can't produce results from fields that don't exist.

See if this run-anywhere query helps.

|makeresults | eval _raw="Date     Rsource status 
10:00:00 A Success
10:00:00 B Success
10:00:01 A Failure
10:00:02 A Failure
10:00:02 C Failure
10:00:02 B Failure
10:00:02 A Success
10:00:03 B Success
10:00:03 A Failure
10:00:04 A Failure
10:00:04 C Failure
10:00:04 B Failure" | multikv forceheader=1 | eval _time=strptime(Date, "%H:%M:%S") | sort _time | rename Rsource as resource_id
```Above just sets up test data```
| eval OccurenceDate=strftime(_time,"%Y-%m-%d %H:%M:%S")
| streamstats time_window=30s global=true min(OccurenceDate) as start max(OccurenceDate) as end count as numberofstatus BY status,resource_id reset_on_change=true
| fields start,end,start,resource_id,numberofstatus,status
| where status="Failure" and numberofstatus>1

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...